I think the implication is zero-click exploit.

But if that’s the case it should be fairly simple to reverse engineer whichever exploit they’re using.