Update: XcodeGhost Attacker Can Phish Passwords and Open URLs via Infected Apps
researchcenter.paloaltonetworks.com