Google security experts recently uncovered an “indiscriminate” hacking operation that targeted iPhones over a period of at least two years. It also used websites to implant malicious software to access photos, user locations and other data.

 

In a post on the blog of Google’s Project Zero security taskforce, cyber experts did not name the hacked websites hosting the attacks. They, however, estimated that these websites received thousands of visitors every week.

 

“Simply visiting the hacked site was enough for the exploit server to attack your device,” said Project Zero’s Ian Beer. If it was successful, it would then install a monitoring implant.

 

Once installed, the malicious software “primarily focused on stealing files and uploading live location data.” Beer added that it had been able to access encrypted messenger apps like Telegram, WhatsApp and iMessage.

 

The hack also affected Google Hangouts and Gmail on iPhones. That, in turn, provided a detailed breakdown of how the malicious software targeted and exploited iPhone vulnerabilities.

 

They found most of the targeted vulnerabilities in the iPhone’s default Safari web browser. Beer added that the Project Zero team discovered them in almost every operating system from iOS 10 through to the current iOS 12 version.

 

Once embedded in a user’s iPhone, the malicious software sent back stolen data, including live user location data back to a “command and control server” every 60 seconds.

 

 

Beer said Google initially informed Apple of the attacks in February. Apple subsequently released a security patch for the iOS 12.1.

 

Long the driver of Apple’s money-making machine, iPhone revenue overall was down 12% from last year to $26 billion.

 

The tech giant sent out invitations on Thursday to a September event at its Silicon Valley campus. There, it will unveil a new-generation iPhone.