Malware/spyware surviving factory reset

Hi all,

I have obvious evidence that my phone is infected with malware, as in every sensitive info I put in it invariably gets stolen: passwords, usernames, credentials, you name it, the stuff gets used to access some of my online accounts for intent of impersonation, fraud, vandalism, etc.

As far as I can tell the phone is not jailbroken nor has even been since no one else than I has had physical access to it ever since I purchased it several years ago. At least that would be the official theory since one absolutely needs physical access to install a jailbreak, right?

I think not. I suspect that connecting a phone to a computer infected with a properly coded malware (most likely a rootkit) can get the device jailbroken then infected with malicious firmware code. As the user notices signs of malware he or she resets their phone thinking they had thus gotten rid of the problem... until they notice the fraudulent activity is still active and that, no matter how many times they reset the handset.

So my question is twofold:

1) Is that scenario an actual possibility?

2)If so how do I get rid of it, I suppose the only remedy is to trash the phone, get a new one that I'll never connect to anything else lest I'm 100% sure they're clean? I hope I'm wrong, 'cause I like this phone with its home button/print scanner, with real headphone jack backed with the best DSP-friendly DAC Apple has ever used.

Thanks in advance,

KK