Apple to Alert Users Who Installed Apps Compromised by XcodeGhost

xcode-6Apple has added an XcodeGhost question and answer page to its Chinese website today that explains what the malware is, how some users may be affected and next steps the company is taking to ensure that developers and end users alike are protected against malicious software going forward.

Apple claims that it has no evidence to suggest that XcodeGhost has been used for anything malicious, such as the transmission of personally identifiable information, stipulating that the code is only able to deliver some general information about apps and system information.

Nevertheless, Apple says it is working closely with developers and will soon list the top 25 most popular apps impacted by XcodeGhost on its Chinese website. The company will also be alerting users to let them know if they have downloaded apps that could have been compromised. Many affected apps have since been updated and are no longer infected by XcodeGhost.

Relevant portions of the Apple FAQ for users:

How does this affect me? How do I know if my device has been compromised?
We have no information to suggest that the malware has been used to do anything malicious or that this exploit would have delivered any personally identifiable information had it been used.

We’re not aware of personally identifiable customer data being impacted and the code also did not have the ability to request customer credentials to gain iCloud and other service passwords.

As soon as we recognized these apps were using potentially malicious code we took them down. Developers are quickly updating their apps for users.

Malicious code could only have been able to deliver some general information such as the apps and general system information.

Is it safe for me to download apps from App Store?
We have removed the apps from the App Store that we know have been created with this counterfeit software and are blocking submissions of new apps that contain this malware from entering the App Store.

We’re working closely with developers to get impacted apps back on the App Store as quickly as possible for customers to enjoy.

A list of the top 25 most popular apps impacted will be listed soon so users can easily verify if they have downloaded the latest versions of these apps. After the top 25 impacted apps, the number of impacted users drops significantly.

Customers will be receiving more information letting them know if they’ve downloaded an app/apps that could have been compromised. Once a developer updates their app, that will fix the issue on the user’s device once they apply that update.

We’re working to make it faster for developers in China to download Xcode betas. To verify that their version of Xcode has not been altered, they can take the following steps posted at

iPhone, iPad and iPod touch users should also read our XcodeGhost FAQ to learn more about the malware and how to keep yourself protected.

Apple also outlined steps for developers to validate Xcode using Terminal on OS X.

Popular Stories

hikawa phone grip stand apple%402x

Apple Launches Second Limited-Edition iPhone Accessory in a Month

Friday November 21, 2025 3:53 am PST by
Apple has begun selling the Hikawa Phone Grip and Stand, a new limited-edition iPhone accessory designed with accessibility in mind. Designed by LA-based Bailey Hikawa to celebrate the 40th anniversary of accessibility at Apple, the grip uses magnets to securely snap onto any iPhone with MagSafe. Apple says it can be removed with ease, and doubles as a stand with two different viewing...
iOS 26

iOS 26.2 Adds These New Features to Your iPhone

Thursday November 20, 2025 10:50 am PST by
iOS 26.2 is currently in beta testing. The upcoming update includes a handful of new features and changes on the iPhone, including a new Liquid Glass slider for the Lock Screen's clock, offline lyrics for Apple Music, and more. In a recent press release, Apple confirmed that iOS 26.2 will be released to all users in December, but it did not provide a specific release date. Keep reading...
Apple Shopping Event 2025

Apple Announces 2025 Black Friday Event, Here's What You Can Get

Thursday November 20, 2025 6:28 am PST by
Apple's annual four-day Black Friday through Cyber Monday shopping event is returning on Friday, November 28 through Monday, December 1 in many countries, including the United States, Canada, Australia, New Zealand, France, Germany, Italy, Spain, the United Kingdom, Belgium, the Netherlands, Sweden, Thailand, and others. During the shopping event, customers can get an Apple gift card with...
iOS 26 on Three iPhones

iOS 27 Will Reportedly Have Two Key Upgrades

Sunday November 23, 2025 8:48 am PST by
iOS 27 will reportedly have two major elements: quality improvements and new AI features. In his Power On newsletter today, Bloomberg's Mark Gurman said that iOS 27 will be similar to Mac OS X Snow Leopard, in the sense that Apple is focused on improving "quality and underlying performance" over adding new features. Gurman said there is one exception to this rule, though, as he expects...
maxresdefault

The MacRumors Show: iPhone 18 Pro Looks Like a Huge Upgrade

Friday November 21, 2025 9:10 am PST by
On this week's episode of The MacRumors Show, we talk through all of the new features and improvements expected to come to next year's iPhone 18 Pro and iPhone 18 Pro Max models. Subscribe to The MacRumors Show YouTube channel for more videos Apple's next-generation iPhones are less than ten months away and we already have a good idea about what to expect based on corroborated leaks, rumors,...
Apple Foldable Thumb

Foldable iPhone to Debut These Two Breakthrough Features

Wednesday November 19, 2025 7:26 am PST by
Apple's first foldable iPhone is expected to launch alongside the iPhone 18 Pro models in fall 2026, and it's shaping up to include two standout features that could set it apart from the competition. The book-style foldable will reportedly feature an industry-first 24-megapixel under-display camera built into the inner display, according to a recent JP Morgan equity research report. That...
General Black Friday Deals 25 Red

Apple Black Friday Deals Available Now on AirPods, iPads, Accessories, and More

Friday November 21, 2025 8:48 am PST by
We're only a few days away from Black Friday, which will take place on Friday, November 28 in 2025. As always, this will be the best time of the year to shop for great deals, including popular Apple products like AirPods, iPad, Apple Watch, and more. In this article, the majority of the discounts will be found on Amazon. Note: MacRumors is an affiliate partner with some of these vendors. When...
ipad black friday 2025

The Best Early Black Friday iPad Deals

Thursday November 20, 2025 10:20 am PST by
Black Friday is just over a week away, and iPad deals have finally started to flood in at retailers like Amazon and Best Buy. Below we're tracking discounts on every current generation iPad, including lowest-ever prices on M3 iPad Air and M5 iPad Pro, plus steep markdowns on iPad and iPad mini. Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a ...
iPhone 17 Pro Cosmic Orange

10 Reasons to Wait for Next Year's iPhone 18 Pro

Wednesday November 19, 2025 4:00 am PST by
Apple's iPhone development roadmap runs several years into the future and the company is continually working with suppliers on several successive iPhone models at the same time, which is why we often get rumored features months ahead of launch. The iPhone 18 series is no different, and we already have a good idea of what to expect for the iPhone 18 Pro and iPhone 18 Pro Max. One thing worth...

Top Rated Comments

Analog Kid Avatar
133 months ago
The lesson to be learned is that you can't trust Chinese businesses, not without some research into their business practices anyway. But that's basic internet common sense isn't it?
I wouldn't pin this on any one country. Look at the mess Volkswagen just got themselves into. GM let faulty ignition switches keep killing people even after they knew it was happening. Japanese airbags.

Corruption can happen anywhere. It just so happens that a lot of low cost, under-regulated business is happening in China right now. Germany, the US, and Japan don't have that excuse, but they let it happen too. I think it's easy to fall back on stereotypes and say that the events in some countries are "unique" and in other countries it's "endemic" without thinking it through.

Edit: I just noticed you said "internet common sense", which I recognize as being different from actual common sense...
Score: 5 Votes (Like | Disagree)
mw360 Avatar
133 months ago
Apple should have caught the infected apps before approving them, but perhaps the main lesson to be learned here is to take great caution when downloading an app from a third-party server. In particular, download Apple apps from Apple only. This was easily avoidable and unwise developers created a huge mess.
How could apple have caught these apps? It's not like they simply failed to run a virus scan. The infection was completely unknown and doesn't do anything particularly dramatic to trigger alarm bells. There's virtually nothing to detect other than some fairly routine device polling.

Does this sound like a downplay to anyone?
Apps removed, users informed personally, C&C server taken down, devs notified. What's left for Apple to do, run around with their pants on their heads?
Score: 4 Votes (Like | Disagree)
Analog Kid Avatar
133 months ago
Apple really didn't think their security through.
I think that's a bit unfair. Apple software is remarkably secure, and they do take a lot of proactive steps to keep it that way. Sandboxing, code signing, GateKeeper, App Store approvals, etc all get a lot of resistance when they come out, but have had a positive affect on security.

What bothers me a little bit is that they really don't respond quickly to outside reports of vulnerabilities until they threaten bad press. I almost think they think security through very carefully, and have many very competent people focused on the problem, but suffer from some arrogance induced blindness.
Score: 4 Votes (Like | Disagree)
JonneyGee Avatar
133 months ago
Apple should have caught the infected apps before approving them, but perhaps the main lesson to be learned here is to take great caution when downloading an app from a third-party server. In particular, download Apple apps from Apple only. This was easily avoidable and unwise developers created a huge mess.
Score: 3 Votes (Like | Disagree)
Analog Kid Avatar
133 months ago
Why only the top N apps infected?! Shouldn't they list and take down all the apps infected? I don't think there's any reason to protect the developers here-- they made a grave error and should be accountable to it.

Why are they only sharing this information in China-- some of those apps are used globally.

Why did this take so long to provoke a reaction? When this report first came out 6 days ago, Apple should have sounded an internal alarm and gotten information within hours that would lead to action the same day.

I get that this isn't the end of the world, it's most likely a minor trojan that was mostly likely thwarted by Apple's security design. Still, it shouldn't be taken this casually. I don't care if the big picture impact is minimal-- we rely on App Store review to protect us from this nonsense, and it was circumvented because someone created a rogue version of an Apple branded product. I'd feel much more comfortable if Apple had moved on this more aggressively.
Score: 3 Votes (Like | Disagree)
Michaelgtrusa Avatar
133 months ago
Does this sound like a downplay to anyone?
Score: 3 Votes (Like | Disagree)