For at least two years, hackers engaged in a sustained malware attack on iPhone users, potentially infecting thousands of phones.

The malware was capable of stealing passwords, encrypted messages, chat histories, location data and the iPhone's complete contacts database. Information was then sent to a "command and control" server operated by an unknown hacker or hackers, uploading new data every minute. The hack could include data from popular apps like WhatsApp, Telegram, iMessage and Gmail.

All that was required to be a victim of the hack was visiting specific websites.

The attack was first discovered in January by Google's counter-espionage team, the Threat Analysis Group (TAG), and exposed in detail by Google's Project Zero, a team of security analysts tasked with hunting down vulnerabilities in software. After finding hacked websites delivering malware as part of a "watering hole" attack (in which visitors are infected with malware by visiting a site, rather than seeking out victims via "phishing" or other directed email attacks), TAG reported the vulnerability to Apple.