The malicious software gathers users’ images, contacts and other information.

Ian Beer, from Google’s Project Zero, said in a blogpost that the hacked sites had received thousands of visitors each week.

Beer said: “There was no target discrimination: simply visiting the hacked site was enough for the exploit server to attack your device, and if it was successful, to install a monitoring implant.”

Project Zero is the technology company’s team for examining new security vulnerabilities.

Beer said most of the security flaws were found within Safari, the default web browser on Apple devices.

Operating systems from iOS 10 to iOS 12 were targeted in the hack, which was able to access users’ apps including Instagram, WhatsApp and Gmail.

Google said it reported the security issues to Apple on 1 February. Apple then released an operating system update on 7 February.

Beer said that while the implant was not saved on Apple devices, it could again provide access for hackers when the owner visited a compromised site.

He said: “Given the breadth of information stolen, the attackers may nevertheless be able to maintain persistent access to various accounts and services by using the stolen authentication tokens from the keychain, even after they lose access to the device.”

Apple did not immediately respond to a request for comment.

More about: #iPhone