Just because an app has passed iTunes' verification procedure doesn't automatically mean it's safe. Take this Instagram client called "Who Viewed Your Profile -- InstaAgent" for example, which was available on both iTunes and Google Play until an iOS developer found out that it harvests usernames and passwords.
Full article