[Swordmaker]

It is amazing that almost all of the articles on XcodeGhost fail to mention that the infections are limited to the Chinese Apple App Store, except for a very few apps such as WeChat that were distributed internationally. 99.9% of these affected apps are in the Chinese language.

[Swordmaker]

The XcodeGhost infections in the Chines Apple App Store have been found to now number over 4000 instead of the original 39 originally found. Very few are in any other countries' App Stores. — PING!

Chinese Apple XcodeGhost Piracy
Ping!

The Latest Apple/Mac/iOS Pings can be found by searching Keyword “ApplePingList” on Freerepublic’s Search.

If you want on or off the Mac Ping List, Freepmail me.

[Wayne07]

It looked like 99.% chinese initially, but now that the number jumped from 39 to 4000, all bets are off. It is confirmed people are being infected outside of China, and there are many infected apps in English (though still not confirmed how many are in the US store). Check the updated list here:

http://researchcenter.paloaltonetworks.com/2015/09/malware-xcodeghost-infects-39-ios-apps-including-wechat-affecting-hundreds-of-millions-of-users/#

WinZip
Musical.ly
PDFReader
guaji_gangtai en
Perfect365
网易云音乐
PDFReader Free
WhiteTile
IHexin
WinZip Standard
MoreLikers2
CamScanner Lite
MobileTicket
iVMS-4500
OPlayer Lite
QYER
golfsense
同花顺
ting
installer
下厨房
golfsensehd
Wallpapers10000
CSMBP-AppStore
礼包助手
MSL108
ChinaUnicom3.x
TinyDeal.com
snapgrab copy
iOBD2
PocketScanner
CuteCUT
AmHexinForPad
SuperJewelsQuest2
air2
InstaFollower
CamScanner Pro
baba
WeLoop
DataMonitor
爱推
MSL070
nice dev
immtdchs
OPlayer
FlappyCircle
高德地图
BiaoQingBao
SaveSnap
WeChat
Guitar Master
jin
WinZip Sector
Quick Save
CamCard v.6.5.1

From the article. "Fox-IT (fox-it.com), a Netherlands based security company, checked all C2 domain names from our reports in their network sensors and has found thousands of malicious traffic outside China. According to their data, these iOS apps were also infected:"

[for-q-clinton]

So is this only on jail break phones or is it on a normal iPhone? No way can this be on normal iPhone right? No way could Apple screw up this bad.

[PreciousLiberty]

By the way, the severity of this particular exploit is low. The malware encrypts and uploads the following:

- Current time
- Current infected app’s name
- The app’s bundle identifier
- Current device’s name and type
- Current system’s language and country
- Current device’s UUID
- Network type

It looks a lot more like a proof-of-concept than serious malware.

Reminder, developers - be careful where you get your development tools! (At least the idiots in China who downloaded this should have made sure the checksums matched!)

[JediJones]

https://www.youtube.com/watch?v=RDrfE9I8_hs