The spyware leverages obtained credentials to move laterally, accessing other iCloud services linked to the target, expanding the attack scope. The attacker utilized compromised credentials to log into multiple iCloud accounts, indicating a progression in the attack chain aimed at exfiltrating sensitive data.