A proxy tool used by people in Iran and Syria to bypass local censorship controls seems to be the victim of a new strain of spyware.