Researchers at Google say that hackers have been installing "monitoring implants" in iPhones for at least two years.
The attacks have been carried out via websites that discreetly plant malicious software into phones to gather images, contacts and other data.
The analysts from the tech giant's team for examining security vulnerabilities, Project Zero, said the websites have been visited thousands of times a week.
Ian Beer, from Project Zero, said in the group's blog : "There was no target discrimination; simply visiting the hacked site was enough for the exploit server to attack your device, and if it was successful, to install a monitoring implant."
Mr Beer and the team said that the majority of attacks were found within the web browser Safari and that operating system iOS 10 to iOS 12 were targeted.
The implant could also take data from apps a person was using, such as Instagram, WhatsApp, and Gmail.
Mr Beer added: "This indicated a group making a sustained effort to hack the users of iPhones in certain communities over a period of at least two years."
Mr Beer did not allude to who may be behind the attack.
Google reported the issue to Apple on February 1. Apple then released an operating system update six days later on February 7.
Apple told the BBC it did not wish to comment.
Are you protected?
Apple issued a software update to fix the flaw in February of this year. However to make sure you're protected, you need to ensure your device is running the latest version of iOS.
Head to settings, general, and under software update it should say you're running iOS 12.4.1.
If you're not, you will be given the chance to select to update your phone.
It should take a few minutes to fully update.
