Zero-click exploits use bugs in popular apps like iMessage, FaceTime and WhatsApp. Pegasus can infiltrate a device using the protocol of the app once bugs are found.