Apple has patched a major vulnerability in iMessage that allowed attackers to pull a target's message history through a bogus link. Once clicked, the link pulled data from within the iMessage application and exported it to an outside source. Apple's larger security protections prevented the attack from installing malware or pulling data from outside the iMessage application, but it still represents a significant data breach for any user tempted by clicking on the bogus link.

The attack primarily targeted the OS X version of iMessage, but could also recover messages from iPhones if the target enabled SMS forwarding. The bug was discovered by a trio of researchers — Joe DeMesy and Shubham Shah, with the help of Matt Bryant from Uber's security team — who reported it to Apple before making the details of the attack public. There's no evidence the vulnerability was exploited for criminal purposes before being patched.

The new bug comes just a few weeks after researchers at Johns Hopkins published a way to view sent photos and videos, a vulnerability that was patched with iOS 9.3. That attack worked by masquerading as an Apple server, then brute-forcing the resulting encryption until the media was decoded.