Once in the target's phone, spyware lets a hacker access almost everything, including all messages, emails and incoming or outgoing calls, as well as pictures, cameras, microphones and location data.

Another customer discovered a rogue wireless access point had allowed a hacker access to sensitive records.

Hackers accessed up to 1.2m email addresses, names and phone numbers, and grabbed 21,000 unique bank account numbers and sort codes.

Unwitting hotel guests accept the upgrade, granting hackers access to all their confidential data.

The researchers have not revealed which apps are flawed, to avoid hackers accessing private information.