When a company sells a 0-click exploit like that, they don't sell the actual malware/exploit, they sell access to a service or product. The contract will likely have a certain number of attacks with additional infections having a set price of $XXk.
That is how companies like Crowdfense can pay up to $5 million for an exploit. The sell it to some service (or have the service themselves) and generate revenue off of that. The person who sells that exploit gets some of that revenue, they're not getting $5 million up front.
Comments
When a company sells a 0-click exploit like that, they don't sell the actual malware/exploit, they sell access to a service or product. The contract will likely have a certain number of attacks with additional infections having a set price of $XXk.
That is how companies like Crowdfense can pay up to $5 million for an exploit. The sell it to some service (or have the service themselves) and generate revenue off of that. The person who sells that exploit gets some of that revenue, they're not getting $5 million up front.