You may have noticed that Mobile Threat Monday, a series ostensibly about malware on all mobile platforms, tends to focus almost exclusively on Android afflictions. The fact is Apple's strict content restrictions do keep iPhones and iPads more secure than the competition. So the recent reveal from Palo Alto Networks that about 40 apps on the App Store were secretly laden with malware came as a shock.

But while there are steps users can take to combat malware on Android devices, fighting this rare iOS exploit is mostly up to the developers.

XcodeGhost Riding the Whip

The infected iOS apps, from Chinese instant messaging services to international business card scanners, were all compiled with XcodeGhost. Xcode is the suite of software tools Apple provides developers for creating legitimate apps. XcodeGhost is a malicious, duplicate version of those same tools that will lace the apps it creates with commands to harvest data from the host device and transmit that potentially sensitive information to a remote server.

After learning more about the infected apps, like CamCard, Tencent's WeChat, NetEase music app, and Didi Kuaidi's Uber-like car-hailing service, what was most discouraging was that many of them were otherwise on the level. They were real apps made by trustworthy developers who unwittingly unleashed this malware onto millions of customers for potentially as long as six months.

But why would a developer use XcodeGhost when they could just get the real thing from Apple? After all, even if you didn't know XcodeGhost was malicious, using counterfeit software is still pretty shady. Well, according to Palo Alto, in some parts of the world downloading these cracked versions of Apple's tools is a lot faster and more feasible than using the official channels. And hackers prey on vulnerable developers, too, not just users.

The Developer's Burden

Mobile security experts are calling XcodeGhost the largest App Store breach in history. Although Apple has removed many of the dangerous apps, there could still be more out there on the iOS App Store and Mac OS X App Store, too. XcodeGhost is the first iOS/OS X compiler malware, and overall the sixth malware that has snuck onto the App Store after LBTM, InstaStock, FindAndCall, Jekyll, and FakeTor.

What makes iOS malware so dangerous is that if it manages to successfully infiltrate the ironclad App Store, it's very difficult to detect after the fact. Also, because Apple's security features make iOS anti-malware software basically impossible, there's really not much users can do either.

Instead, it's the developers' responsibility to keep customers safe. You could argue that Apple's stringent, lengthy, and costly review policies could've caused developers to use XcodeGhost out of frustration. But those same policies are also what make iOS malware like XcodeGhost so incredibly rare. So developers should play ball, and not use malicious tools, so consumers don't suffer. With brand new iPhones and iPads almost here, Apple fans are gearing up for their annual holiday. Here's hoping it doesn't get ruined by malware.