Originally spotted by SourceDNA, Youmi baked tracking and collection tools into the advertising API without telling developers. Apple is working with the affected developers to get the apps back on the market, which total 1 million downloads.
Youmi was able to collect device serial numbers, apps installed, and Apple ID email addresses. This information can be sold on the black market for a price, especially the email addresses that spammers could use to pretend to be Apple.
The advertising API was incapable of much else however, which hopefully means even iPhones and iPads that aren’t updated won’t be hit with malicious attacks. Apple is working to make sure all users affected are safe and updated to the latest version of iOS.
It is one of the rare occasions the review team failed to spot a non-verified API. In China, development is much less centered around Xcode, meaning developers can sometimes download fake APIs without knowing.
Apple has cautioned developers in the past about developing outside of Xcode. It claims that those apps are more vulnerable to malicious attacks, which stem from Apple being unable to verify the contents. Proof of this happened last month, when 25 apps including Tencent’s WeChat and Baidu Music were pulled for using a fake version of Xcode.
Another malicious app offered users the ability to use a defunct media player, which, once downloaded, ran full-page Safari ads and blocked users from removing it. At home in the U.S., Apple also removed a bunch of apps that offered a way to block native ads inside of apps, most notably the controversial app Been Choice.
Editors' Recommendations
- Google’s Gemini AI app gets a wider release. Is your phone on the list?
- Google is making it easier to ditch your iPhone for an Android phone
- Here’s how iOS 18 could change the way you use your iPhone
- Perplexity, one of our favorite AI apps, just got a big update
- Apple’s AI plans for the iPhone just leaked. Here’s everything we know
