I would describe this spyware's "illegal" status as colloquially true - despite the lack of a comprehensive, international, enforceable legal framework - at least in the USA [0]:

> As part of this effort, the End-User Review Committee of the BIS decided to add four foreign entities, among them two Israeli companies, NSO Group and Candiru, to the Entity List. The U.S. Export Administration Regulations (‘EAR’) impose additional license requirements for exports to listed entities, and limits the exceptions for exports, reexports, and transfers to such entities.

But they continue:

> The existing international and national frameworks regulating the export of sensitive spyware technologies lack the teeth necessary to deal with contemporary issues relating to the abuse of these technologies and the growing need for their enhanced supervision.

[0]: https://www.law.georgetown.edu/ctbl/blog/managing-risky-busi...