“In the case of this campaign, if the target went to any ‘http’ site, the attackers injected traffic to silently redirect them to an Intellexa site, c.betly[.]me.”
Intellexa built a three-bug iPhone chain, Safari to kernel, delivered by injecting traffic into any plain HTTP page the target loaded in Egypt. No click, no attachment, no call. The fix Google offers is HTTPS-First Mode, on by default only for its Advanced Protection users, so everyone else stays one http link from Predator.