Have there been notable cases of a malicious actor installing a compromised OS on a target's phone for spying purposes?