Most people picture mobile surveillance the same way: a target clicks a malicious link, spyware installs, and an attacker gains access. It's a tidy mental model. It's also increasingly incomplete.