Can a fraudster add malware to an app that's already in the app store?
CrowdStrike broke into the App Store and bypassed the security validation mechanism. Their CTO describes the demo conducted at a conference a few years ago. (From the ATM & Mobile Executive Summit.)