2.5.3 — Malware transmission

This is Apple's baseline anti-malware rule — any code that behaves like a virus, spyware, or unauthorized remote-access tool, even bundled inside an otherwise legitimate app, is an automatic rejection.

Almost always traced to a compromised or malicious third-party SDK pulled in through a dependency, rather than code the developer wrote themselves.

The short version, in more detail

Guideline 2.5.3 is Apple's baseline against malicious code. An app that includes code designed to damage a device, gain unauthorised access or transmit malware is rejected outright. Almost every case involves a compromised third-party library, not code written by the developer.

Why this rule exists

Mobile devices hold personal messages, photos, location history and payment credentials, so a single malicious app can do serious harm. Apple's review model depends on users being able to install apps from the Store without having to judge their safety, which is why code that behaves like malware is treated as grounds for immediate rejection and, in confirmed cases, removal. Because modern apps are assembled from many third-party components, the rule also quietly pushes developers to know what is inside their own binaries.

What this guideline covers

• Code that behaves like a virus, spyware or remote-access tool.
• Compromised dependencies and SDKs.
• Unauthorised access to device functions or data.
• Transmission of malicious content.

What usually triggers this rejection

• A third-party SDK that contains hidden harmful behaviour.
• Code that collects data without the user's knowledge.
• Unexpected network connections to unknown servers.
• Attempts to gain privileges beyond what the app should have.
• Obfuscated components that hide their function.

How reviewers evaluate it

• Automated analysis and network inspection look for suspicious behaviour.
• Reviewers act on reports from security researchers.
• The developer is held responsible for included dependencies.
• Confirmed cases may lead to removal and account action.

Common misunderstandings

• Intent matters less than what the code does.
• A small app can still be affected through a dependency.
• Open-source libraries can be compromised too.

Common questions