CNET reports on the discovery of Windows malware embedded within an iPhone application available through the App Store. But rather than a directed attack at Windows users, the malware appears to have been accidentally included from an infected developer's system. The malware is also relatively old and easily detected by most antivirus software for Windows once the App Store package has been unwrapped.

The malware was first discovered by a user posting in the Apple support forums who noted that a download of Instaquotes-Quotes Cards For Instagram from developer Ilyas Hassani triggered warnings from the ClamXav antivirus software for Mac. While the Windows malware obviously could not harm the user's OS X installation, it was flagged as an infected file posing a danger to Windows systems. After learning about the discovery, CNET performed additional testing on the download to confirm that it was not a false positive.

Since the downloaded .ipa file is a package, these executables could be extracted using the package manager Pacifist, and then more accurately scanned. Afterward, other malware programs like Sophos that initially missed detecting the malware instantly picked it up and described it as "Mal/CoiDung-A," a worm written in visual basic that installs files within the Windows system directory and then modifies the Windows registry to execute the malware when the system is restarted.

Copying the malware to a Windows virtual machine running the latest version of Microsoft Security Essentials resulted in the malware being immediately detected and removed from the system.

instaquotes iantivirus scanIt is unclear exactly how or why the malware came to be included in the App Store package, but it seems almost certain to have been an accidental inclusion. As delivered inside the application package, it appears to pose no harm to Windows users, who would have to decompress the package and manually run the infected file in order to expose themselves to the malware.

The infected application debuted in the App Store on July 19 and is currently still available for download after a temporary price drop from $0.99 to free over the weekend.

Top Rated Comments

outphase Avatar
135 months ago
This serves as a reminder that antivirus software for Mac (and Linux) is primarily for stopping the spread of Windows viruses.
Score: 16 Votes (Like | Disagree)
nuckinfutz Avatar
135 months ago
Get a Mac!!!


I keep reading that Windows doesn't collect virus anymore yet continually I see the
ramifications of believing this.
Score: 13 Votes (Like | Disagree)
sulliweb Avatar
135 months ago
I have to admit I'm more curious than concerned. I thought app development had to be done in X-Code, which only runs on a Mac. If so, the coding and work had to be done on a Mac. That being the case, how would Windows malware, even acidentally, end up in the app itself?

Obviously, I'm not a developer, so I'm sure I'm missing something, just curious as to what...
Score: 7 Votes (Like | Disagree)
haincha Avatar
135 months ago
I am just curious how that happens? The only thing I can think of is that he has BootCamp or something with software to open up mac folder system on Windows. Because, even if the exe filed came on the mac side, it wouldn't be able to replicate itself or put itself into any random folders.

Then, why choose that particular folder? It isn't showing up in every folder path. Even if he says it wasn't deliberate, is it possible to get there, and only there, without it being on purpose?
Score: 4 Votes (Like | Disagree)
AriX Avatar
135 months ago
Sounds like Apple should run a virus check on App Store packages before approving them!

But .ipa files are not packages, as the article indicates, they're just renamed ZIP files. Pacifist should not be necessary to open them; just rename the file to something.zip and double click it.
Score: 3 Votes (Like | Disagree)
Amazing Iceman Avatar
135 months ago
It is very suspicious how it bundled itself in an .ipa file.
Windows viruses usually attach to Windows files known to be executables or have vulnerabilities that allow it to execute.
An .ipa file is totally foreign to Windows, and the locations where the virus installed itself are too much to be a mere coincidence.
Weird... just weird...
Score: 3 Votes (Like | Disagree)

Popular Stories

General Black Friday Deals 2022 Green

All the Apple Black Friday Deals You Can Still Get

Friday November 25, 2022 4:40 am PST by
Although Black Friday is now technically over, many Apple products are still seeing major discounts through the weekend as we head into Cyber Monday. In this article, you'll find every Apple device with a notable Black Friday sale that's still available. We'll be updating as prices change and new deals arrive, so be sure to keep an eye out if you don't see the sale you're looking for yet. Note:...
iphone 14 pro hands snowflakes 1

Best Cyber Monday iPhone Deals Available Today

Wednesday November 23, 2022 1:55 pm PST by
Cellular carriers have always offered big savings on the newest iPhone models during the holidays, and Cyber Monday is no different. We're tracking notable offers on the iPhone 14 and iPhone 14 Pro devices from AT&T, Verizon, and T-Mobile. For even more savings, keep an eye on older models like the iPhone 13. Note: MacRumors is an affiliate partner with some of these vendors. When you click a...
maxresdefault

Nothing Phone 1 Displays AirPods Battery Level After Latest OS Update

Friday November 25, 2022 3:33 am PST by
Nothing Phone 1 users today began receiving the Nothing OS 1.1.7 update, which adds support for displaying the battery percentage of connected AirPods, amongst other improvements and bug fixes. If you own a Nothing Phone 1, you can check for the OTA update by going to Settings -> System -> System updates. Bear in mind that as support for displaying AirPods battery level is still an...
ipad holiday bulbs

Best Cyber Monday iPad Deals Available Today

Thursday November 24, 2022 12:25 pm PST by
Cyber Monday deals have been in full swing since Black Friday deals ended, and we're seeing solid discounts on Apple devices. We're highlighting the best sales for all of Apple's product lines, and in this article you'll find the best Cyber Monday sales on iPad, iPad Pro, iPad Air, and iPad mini. Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make ...
airpods pro 2

Apple Engineer Addresses Lack of Lossless Support on New AirPods Pro

Friday November 25, 2022 2:58 am PST by
An Apple engineer has addressed the lack of lossless audio support in the second-generation AirPods Pro in a new interview. Current Bluetooth technology in the AirPods lineup means that Apple's audio products do not support Apple Music Lossless audio. Apple has previously hinted that it may develop its own codec and connectivity standard that builds on AirPlay and supports higher quality...
Cyber Monday Deals Feature 2022

Best Cyber Monday Apple Deals Still Available for AirPods, Apple TV, iPad, and More

Monday November 28, 2022 5:24 am PST by
The Black Friday and Cyber Monday holiday shopping rush is drawing to a close, but there are still some good deals to be had out there. For Apple products, many of the deals you've seen since last week are still available, though some have expired. So for anyone who missed out on Black Friday deals, there's still an opportunity to get some of the year's best prices on many Apple devices. Note: ...
Apple Watch Ultra Oceanic Plus App

Apple Announces Oceanic+ App Now Available for Apple Watch Ultra

Monday November 28, 2022 6:11 am PST by
Apple today announced that the Oceanic+ app is available for the Apple Watch Ultra starting today. Designed by Huish Outdoors in collaboration with Apple, the app serves as a dive computer for recreational scuba diving at depths up to 40 meters/130 feet. Apple already offers a basic Depth app on the Apple Watch Ultra for viewing your current depth, maximum depth reached, water temperature,...
Three Biggest iPhone SE 4 Questions Feature

Three Biggest Questions About the iPhone SE 4

Saturday November 26, 2022 12:00 am PST by
While we already have some clear indications about what to expect from the fourth-generation iPhone SE, there are three major questions looming over the device at the current time. Chinese site MyDrivers and and leaker Jon Prosser believe that the iPhone SE is set to move to an iPhone XR-like design in its next incarnation, which would involve eliminating the Home button and adding a "notch" ...