I’m curious if more will come out of this but it sounds like the attackers probably already attacked Julie or her employer (she appears to have worked for Tile,

I’m curious if more will come out of this but it sounds like the attackers probably already attacked Julie or her employer (she appears to have worked for Tile, Oculus and others) and just signed the app with her ID. I bet they have a ton of these credentials in their pocket from previous infections. Since this didn’t go through the App Store it probably wasn’t reviewed but the developer’s certificate would be checked when it’s run - hence the revocation now.