Apple withdraws some China apps after malware found

BEIJING -- Apple Inc. has removed some applications from its App Store after developers in China were tricked into using software tools that added malicious code in an unusual security breach.

Apple gave no details of which companies were affected.

But Tencent Ltd. said its popular WeChat app was affected, and the company released a new version after spotting the malicious code.

Chinese news reports said others affected included banks, an airline and a popular music service.

The malicious code spread through a counterfeit version of Apple's Xcode tools used to create apps for its iPhones and iPads, according to the company.

It said the counterfeit tools spread when developers obtained them from "untrusted sources" rather than from the company.

The malicious software collects information from infected devices and uploads it to outside servers, according to Palo Alto Networks, a U.S.-based security firm, which investigated the malware.

It first was publicized last week by researchers at Alibaba Group, the e-commerce giant, who dubbed it XcodeGhost.

Cybersecurity experts say the episode shows any device, including those running Apple's iOS software, can be vulnerable to hackers, even though Apple is known for scrutinizing apps that are offered in its store.

"I wouldn't say that the floodgates for iOS malware are open now, but this vector is probably something that other attackers are going to try to replicate in the future," said Ryan Olson, director of threat intelligence for Palo Alto Networks.

He said Apple undoubtedly is working on improving its ability to block similar attempts.