This technique can be found in infostealers targeting jailbroken iOS devices. The idea here is to intercept certain APIs in order to get access to sensitive data before it gets encrypted or after it has been decrypted. An example could be KeyRaider, targeting SSLRead and SSLWrite from the itunesstored process with the help of Cydia Substrate/MobileSubstrate:
Figure 11: A parsed .plist file from one of KeyRaider's modules
Another threat, AppBuyer, hooks the connectionDidFinishLoading method of the ISURLOperation class using the same framework.