The malicious app is still on Apple’s App Store four days after it was first discovered and flagged by App Store users.