Wait, seriously? Any sources on that? I find it hard to believe that any government would spend $$$ on a security tool that doesn't allow on-prem installation and instead beams all your surveillance to another country.
source: https://www.money.pl/archiwum/wiadomosci/artykul/usa;nie;uja...
Indirectly, all software vulnerability tools that send source code and other artefacts to servers outside government's control give third parties access to information about potential attack vectors, software vulnerabilities, and infrastructure layout.
What do these phones look like and who manufactures them?
I guess this is all according to NSO claims. I’d like to see evidence otherwise!
from what I heard about Pegasus: noone could get that malware for themselves to not compromise it, so it's you wanted to hijack some phone you would send them phone number so they could resend exploit again (spyware was not persistent across reboots, so you needed to rehack it every time)