Sandjacking, as this attack is called, grants an assailant access to an application’s sandbox content. Sandjacking works by backing up the device and removing the original application to replace it with a rogue version. Once the device owner initiates the “restore from backup” function, the corrupted application will automatically be installed. While the user will need to manually approve on these apps, it is very likely they will just go through the list without giving it a second thought.
http://bitcoinist.net/sandjacking-ios-bitcoin-ethereum/
