The advisory said that the "high" severity attack campaign usually begins with the victim receiving a message like "Hi, check this photo" from a "trusted" contact.