Pay attention to iOS applications that require that you enter the Settings menu to complete application setup. Remember, this is not a normal way to Download and Install iOS applications. This process could end up creating unwanted profiles on an iOS device for the propagation of spam or possibly malware.

Provisioning profiles are a legitimate developer tool used to provide access for testing. In fact, if you are doing development work, it is not uncommon to have profiles installed for things like Beta release versions of iOS software. By their nature, they have unique characteristics that give them certain permissions on devices that have granted authorization. This could mean the creation of root-level certificates and new accounts.

Examine the device for any provisioning profiles that the user did not setup, or that may have been setup inadvertently for possible insights into the strange behavior. On the device, Profiles can be found by going to Settings > General > Device Management. It is possible, because of having a corporate or company-owned device, that you have a legitimate profile installed; if you don’t fit this category, investigate any of the suspicious profiles. The absence of the Device Management option means that no profiles are installed on the device. Suspicious profiles can be removed from this location as well.

One well-known application, Weather Underground, had unsuspecting users installing provisioning profiles after an application upgrade, which created new email accounts on devices for the purpose of receiving SPAM.

References:

[1] https://for585.com/iosprovisioningprofiles

[2] https://for585.com/iosprofilemisuse