Xcodeghost again

I have 4x Mac (3x El Capitan and 1 Leopard on G5) and 2x iPhone 5s (iOS 9.0.2) in my company's network. Some time ago, our provider has blocked me some internet ports. He reasoned that by our network of retired virus "Xcodeghost". This was repeated again after a week. In my iPhones has not been installed, none of the published infected applications. Yet I factory reset both phones and download all applications from iTunes AppStore. I re-installed all 3 Macs El Capitan as clean install and router too. I changed all access passwords, for sure. The problem was solved.

Now the problem reappeared again. Both iPhones are no other applications since then – only original requested updates from the iTunes Store. No other device is connected to my network.

I don’t know what to do. I never found any instrument from Apple that would help and advise how the malware found. Anyone have any advice, please? Thanks.