The attack begins when a victim unknowingly installs a malicious app on their Google or Samsung phone.