A major vulnerability in messaging app WhatsApp allowed attackers install spyware onto phones.
Facebook - which owns the messaging app - said the attack targeted a "select number" of users.
WhatsApp has urged all of its 1.5 billion users to update their apps as an added precaution.
According to the Financial Times, the vulnerability was developed by Israeli cyber intelligence firm NSO Group.
WhatsApp told the paper that the vulnerability "has all the hallmarks of a private company known to work with governments".
It's not yet known who carried out the attack.
The spyware targeted users through the WhatsApp call function - and could be installed even if the user did not answer their phone.
Researchers believe the exploit was used as recently as Sunday to unsuccessfully target a human rights lawyer.
WhatsApp has just pushed out updates to close a vulnerability. We believe an attacker tried (and was blocked by WhatsApp) to exploit it as recently as yesterday to target a human rights lawyer. Now is a great time to update your WhatsApp software https://t.co/pJvjFMy2aw https://t.co/e8VQUraZWQ
— Citizen Lab (@citizenlab) May 13, 2019
The vulnerability impacted both iOS and Android devices, according to a security note from Facebook.
However, engineers in WhatsApp have now rolled out updates to close the vulnerability.
A WhatsApp spokesperson said: “WhatsApp encourages people to upgrade to the latest version of our app, as well as keep their mobile operating system up to date, to protect against potential targeted exploits designed to compromise information stored on mobile devices.
"We are constantly working alongside industry partners to provide the latest security enhancements to help protect our users.”
In a statement quoted by the Financial Times, the NSO Group said it was investigating the issue, adding: “Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies."
On its website, NSO says it develops technology aimed at helping "government security and intelligence agencies protect their citizens against terror, crime, and other major security threats".
It stresses that it will investigate "any credible allegation of product misuse".
Amnesty International yesterday said it was supporting a legal action in Israel aiming to revoke the export license of NSO Group - claiming the firm's products have been used in "chilling attacks" on human rights workers, activists and journalists.
