Hackers have been using compromised websites to install “monitoring implants” in iPhones for years, according to researchers at Google. The malicious software gathers users’ images, contacts and other information.

Ian Beer, from Google’s Project Zero, said in a blog post that the hacked sites had received thousands of visitors each week. “There was no target discrimination; simply visiting the hacked site was enough for the exploit server to attack your device, and if it was successful, to install a monitoring implant.”

Project Zero is the technology company’s team for examining new security vulnerabilities.

Beer said most of the security flaws were found within Safari, the default Web browser on Apple devices.

Operating systems from iOS 10 to iOS 12 were targeted in the hack, which was able to access users’ apps including Instagram, WhatsApp and Gmail. Google said it reported the security issues to Apple on 1 February. Apple then released an operating system update on 7 February.

Beer warned that while the implant is not saved on Apple devices, it can again provide access to hackers when the owner visits a “compromised site”.

“Given the breadth of information stolen, the attackers may nevertheless be able to maintain persistent access to various accounts and services by using the stolen authentication tokens from the keychain, even after they lose access to the device,” he said.

Apple did not immediately respond to a request for comment.