An overlay attack is a mobile attack technique in which malware displays a fake window on top of a legitimate app – usually a banking or payment app – to trick the user into entering credentials or card data.
How overlay attacks work
An overlay attack is the signature technique of Android banking trojans. After installation, typically via a dropper app or a link in smishing messages, the malware asks for permissions such as “display over other apps” (SYSTEM_ALERT_WINDOW) or accessibility services. It then:
- downloads a list of target apps and matching fake login screens (injects) from its server;
- watches which app is in the foreground;
- when a target app opens, instantly draws a pixel-perfect copy of its login or card entry screen on top;
- sends whatever the user types to the attackers.
Overlays can also hide malicious actions: a harmless-looking layer prompts the user to tap, while the taps actually grant permissions underneath – the idea behind the 2017 “Cloak & Dagger” research. MITRE ATT&CK for Mobile describes the technique as Input Capture: GUI Input Capture (T1417.002).
Why overlay attacks matter
Overlays let malware steal banking passwords, card numbers and one-time passwords without breaking the bank’s own app. Families such as BankBot, Anubis, Cerberus, Anatsa and many infostealers target hundreds of banking, crypto and shopping apps at once. Google has gradually restricted overlay and accessibility permissions in newer Android versions and on Google Play, which pushes attackers towards sideloaded apps and social engineering.
How to protect against overlay attacks
- Install apps only from official stores and avoid links to APK files.
- Do not grant “display over other apps” or accessibility access to apps that do not clearly need it.
- Keep Android and Google Play Protect up to date.
- Be suspicious if a login screen appears unexpectedly or asks for full card details.
