The problem, though, is that evidence is relatively difficult to find. ZecOps found its evidence through hints in iOS, and couldn’t obtain the malware as the messages had already been deleted. Jamf Software security researcher Patrick Wardle also told the WSJ that the evidence of ongoing attacks was “compelling,” but not authoritative.

We’ve asked Apple for comment. The investigators believe Apple has fixed the flaw in an iOS beta (presumably 13.4.5), though, so it may not be an issue for long. If the findings are accurate, though, they suggest that a patch is coming long after hackers dealt their damage — however limited it might have been.