A WhatsApp vulnerability has reportedly been used in highly targeted attacks to install spyware on victims' phones.