Jail-broken means modified to run apps not sanctioned by Apple.
"We believe this to be the largest known Apple account theft caused by malware," computer security firm Palo Alto Networks said in an blog post.
An attack using malicious code dubbed "KeyRaider" was discovered by WeipTech, an amateur technical group from Weiphone, described as one of the largest Apple fan websites in China, according to Palo Alto Networks.
In July, WeipTech members began investigating reports that some people's Apple accounts were used to make unauthorized purchases or application installations.
WeipTech worked with Palo Alto Networks to uncover KeyRaider.
KeyRaider is being distributed through Cydia repositories in China but may be affecting users in 18 countries including France, Australia, and the United States, according to Palo Alto Networks.
Cydia repositories are locations where software for jail-broken iPhones can be found and installed.
KeyRaider targets Apple mobile devices that have been jail-broken, or modified to be able to run applications or other software not sanctioned by the California-based maker of iPhones, iPads, and iPods.