Over the weekend, news reports of “hacked” iTunes accounts used to purchase worthless apps surfaced. And since there was no evidence nor report of an iTunes App Store data leak, it is most likely that individual iTunes user credentials were stolen via phishing attacks. What’s interesting about this incident is it doesn’t involve any malicious app

See the article here:
Cybercriminals Make Money Out of App Store