From TechnologyReview.com:
Mystery has long shrouded how Apple vets iPhone, iPad, and iPod apps for safety. Now, researchers who managed to get a malicious app up for sale in the App Store have determined that the company’s review process runs at least some programs for only a few seconds before giving the green light.
This wasn’t long enough for Apple to notice that an app that purported to offer news from Georgia Tech contained code fragments that later assembled themselves into a malicious digital creature. This malware, which the researchers dubbed Jekyll, could stealthily post tweets, send e-mails and texts, steal personal information and device ID numbers, take photos, and attack other apps. It even provided a way to magnify its effects, because it could direct Safari, Apple’s default browser, to a website with more malware.
To be fair, this was a "proof-of-concept" attack. It was carried out by researchers from Georgia Tech who only infected their own phones and then pulled the app down from the store themselves. However, if these researchers figured it out, what's to stop anyone else with more malicious intentions of doing the same thing?
As of the time of the article's publication, Apple was refusing to comment on the app review process, though they did claim to have made some changes to the iOS operating system in response to the identified issues.
