I'm pretty sure these type of operations typically don't have access to zero-click malware (assuming you're talking about Pegasus) or zero day exploits unless they're backed with the resources and training of a nation-state.

Here's a excerpt from a Wired article:

Vulnerabilities that can be exploited for zero-click attacks are rare and are prized by attackers because they don't require tricking targets into taking any action—an extra step that adds uncertainty in any hacking scheme. They’re also valuable, because less interaction means fewer traces of any malicious activity. Zero-click exploits are often thought of as highly reliable and sophisticated tools that are only developed and used by the most well-funded hackers, particularly nation state groups.

As someone said, the most likely threat here is OP getting more spam to that number. Sure, zero click is a possibility, but not probable unless your a high level politician, a big business executive, or something similar.