Initial versions were one-click. The attack became more sophisticated and became zero-click.

See https://en.wikipedia.org/wiki/Pegasus_(spyware)#Development_... for timeline.

See https://en.wikipedia.org/wiki/Pegasus_(spyware)#Saudi_Arabia for the iMessage version.