Why is Pegasus illegal?

Can you explain to me in simple terms why Pegasus is considered illegal? Is it due to the nature of its operations, the way it collects data, or perhaps the potential harm it can cause to individuals and organizations? How does its illegality differ from other similar tools or practices in the field of cybersecurity and surveillance? I'm interested in understanding the specific legal reasons behind its prohibition and the potential consequences for those who use or develop it.