An Apple forum user with the username deesto said in a post that he downloaded the free "Instaquotes Quotes Cards for Instagram" app and his ClamXav tool flagged the file as malware. Further inspection by CNET revealed that the alert was not a false positive and the file did contain a piece of malware known as Worm/VB.LY.24 (Worm.VB-900).
The Worm/VB.LY.24 malware is an older threat that first appeared in 2009. It's written in Visual Basic and infects Windows machines. It is not a threat to iOS or Mac OS X users. If, by chance, you already purchased the infected app, most anti-virus programs should detect the infected file and remove it safely from any Windows system.
Users that haven't downloaded the app don't have to be concerned as Apple removed the app from the iOS App Store.