Cybersecurity company ZecOps recommended iOS users temporarily disable Apple’s Mail app, after discovering a vulnerability enabling hackers to remotely infect and steal information from some iPhones and iPads.

The company explained in a blog attackers exploit the vulnerability by sending users an email specifically designed to exhaust their device’s available memory. While users of the MobileMail app on iOS 12 must open the email, it can apparently happen automatically on the maild service on iOS 13 if the app is open and running in the background.

ZecOps noted Apple’s security team already issued a beta patch for the flaw, but is yet to make the fix broadly available via an iOS update.

The researchers said they discovered the vulnerability while conducting a routine investigation for a customer, with evidence the exploit had been used since at least January 2018.

They identified six targets of such attacks including employees of a North American Fortune 500 company; a Japanese operator executive; a high-profile German individual; managed services providers in Saudi Arabia and Israel; and a European journalist. A seventh suspected hack was aimed at a Swiss enterprise executive.

The company concluded the attacks likely originated from “at least one nation-state threat operator or a nation-state that purchased the exploit from a third-party”, but didn’t reveal further specifics.