The spyware vendor sends a link to a victims phone, which when clicked would download and install a malicious app