The linked NYTimes article references 3 exploits dubbed the "Trident Exploit Chain" that are detailed in an excellent Lookout / Citizen Lab writeup [1] discussed on HN 8 days ago [2].

The target is sent an SMS containing a link to site that triggers the explot chain to remotely jailbreak the phone and clandestinely install the monitoring software.

Ahmed Mansoor, a UAE journalist, was recently targeted with one of these SMS messages and was immediately suspicious. Instead of clicking the link he contacted Citizen Lab researchers who connected it back to NSO group.

[1] https://citizenlab.org/2016/08/million-dollar-dissident-ipho... [2] https://news.ycombinator.com/item?id=12360662