Unauthorized third parties had tampered the Apple’s Xcode software, a code library used by developers of Mac OS X and iOS applications, and published it on the net.
Some developers downloaded it and used it to create their apps and uploaded the apps on Apple App Store.
These apps could communicate with third parties details of your iOS devices and attempted to phish for iCloud passwords.
Apple removed the tainted apps and started working with the developers to make sure they were using the proper version of Xcode to rebuild their apps.
Source: https://grahamcluley.com/ios-app-xcodeghost-malware/
TPRM report: https://scoringcyber.rankiteo.com/company/apple
"id": "app12520422",
"linkid": "apple",
"type": "Cyber Attack",
"date": "09/2015",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Technology',
'location': 'Cupertino, California, USA',
'name': 'Apple',
'type': 'Organization'}],
'attack_vector': 'Supply Chain Compromise',
'data_breach': {'type_of_data_compromised': ['iOS device details',
'iCloud passwords']},
'description': 'Unauthorized third parties had tampered the Apple’s Xcode '
'software, a code library used by developers of Mac OS X and '
'iOS applications, and published it on the net. Some '
'developers downloaded it and used it to create their apps and '
'uploaded the apps on Apple App Store. These apps could '
'communicate with third parties details of your iOS devices '
'and attempted to phish for iCloud passwords. Apple removed '
'the tainted apps and started working with the developers to '
'make sure they were using the proper version of Xcode to '
'rebuild their apps.',
'impact': {'data_compromised': ['iOS device details', 'iCloud passwords'],
'systems_affected': ['iOS devices', 'Apple App Store']},
'initial_access_broker': {'entry_point': 'Compromised Xcode software'},
'motivation': 'Data Theft, Phishing',
'post_incident_analysis': {'root_causes': 'Compromised software development '
'tools'},
'response': {'containment_measures': ['Removed tainted apps from App Store'],
'remediation_measures': ['Worked with developers to ensure they '
'use the proper version of Xcode']},
'threat_actor': 'Unknown',
'title': 'XcodeGhost Malware Incident',
'type': 'Malware',
'vulnerability_exploited': 'Compromised Software Development Tools'}