High-tech cybercriminals have found a way to exploit a flaw in Apple’s software and gain access to targets’ phones by simply sending an email — regardless of whether the recipient opens the email or not, according to cybersecurity company ZecOps.

The firm told the Wall Street Journal that the sophisticated intrusions are different from traditional hacks, which generally involve tricking targets into slicking on an infected message or visiting a specific website. The new technique sees a bug triggered when the email app automatically downloads a message’s data, without the recipient having to do anything at all.

The malware is “virtually undetectable” by users, according to ZecOps, which said that it reached its conclusion after analyzing “digital clues left after an attack within the iPhone’s operating system.” It wasn’t able to get the actual malware because the emails had been deleted.

Patrick Wardle, a security researcher at Jamf Software, told the Journal that ZecOps evidence of the attacks was “compelling,” but said that without having the actual malware it stops short of being definitive.

Targets of the new hacking technique — which ZecOps believes has been in use for at least two years — include employees of a Japanese telecom company, tech companies in Saudi Arabia and Israel as well as a “large North American firm.”

ZecOps investigators believe that the latest patch in a test version of Apple’s iOS software may fix the bug, but it has not yet been widely released as an official update.

Apple did not immediately respond to a request for comment.