From my understanding, the attack can happen through multiple ways. Companies like NSO purchase vulnerabilities for this step and probably have a set of them on

From my understanding, the attack can happen through multiple ways. Companies like NSO purchase vulnerabilities for this step and probably have a set of them on their disposal, ready to deploy ones as they get discovered. Pegasus is the rootkit which is installed once the attack is successful, and allows spying on the user. https://en.wikipedia.org/wiki/Pegasus_(spyware) https://en.wikipedia.org/wiki/Pegasus_(spyware)