What's interesting to me about this is that someone would pay for a scheme that required spear phishing (malicious pdf or other file), whereas other known players in this space base their offerings on zero-click RCEs.