Last year it was revealed that NSO Group had created a system for hacking into the smartphones.
Now Reuters sources say rival QuaDream also exploited the same flaw in the Apple handsets.
Experts analysing intrusions engineered by the two firms say they both used a software exploit known as forced entry.
That gives a hacker access to the phone's data using vulnerabilities in the software.
In this case they used a flaw in Apple's messaging system to plant malicious software.
The firms' tools are meant for use by governments.
But there is widespread concern over how they are used, and by whom.
In one incident the NSO tool was used to spy on U.S. diplomats in Uganda.
Journalists have also documented numerous cases of spyware being used to attack civil society figures.
Apple last year sued NSO, saying it has violated user terms.
The Israeli firm denies wrongdoing, and the case is in its early stages.
An Apple spokesperson wouldn't say how it planned to respond to the new report, while QuaDream didn't respond to requests for comment.
But cybersecurity experts say it raises real doubts over just how secure anyone's phone really is.
