FinFisher documentation says the product can infect computers by falsifying websites or updates of popular software and getting the user to download its software.
Sounds like a pentest...except when you apply context, it's not heh
This is a great link, thanks for sharing!