Yet another example of what I've been telling everyone. Most, if not all, attacks start with social engineering through messaging apps and then links containing JavaScript exploits.
You people need to ditch cellular SIMs (phone numbers) so attackers can't have a way to contact you, and you must stop allowing JavaScript in your browser by default. Do these two things and your attack surface is drastically reduced...