Overlay injection is a fraud technique where malicious content is placed on top of a legitimate app screen to capture credentials, payment data, or approval actions. The user believes they are interacting with the trusted app, while the attacker controls what is actually submitted.
Expanded Definition
Overlay injection is a deception pattern in which a malicious interface is rendered above, alongside, or in place of a legitimate application screen so the user enters data or approves actions into attacker-controlled fields. In mobile fraud, it often appears as a fake login prompt, payment confirmation, or consent dialog that visually matches the trusted app. The technique is not the same as ordinary phishing because the victim may already be inside a real application session, making the abuse harder to detect by visual inspection alone.
Definitions vary across vendors because some security teams classify overlay injection as malware behaviour, while others treat it as a fraud and user-interface abuse technique. NHI Management Group treats it as a session- and interaction-hijack problem with direct implications for credentials, tokens, and approval workflows. The control challenge is not just detecting the malicious layer, but verifying that the screen a person sees is the screen the application intended to present, a concern that aligns with the NIST Cybersecurity Framework 2.0 emphasis on protecting user interaction and transaction integrity. The most common misapplication is assuming any successful login or approval came from the genuine app, which occurs when teams trust the front-end event without validating the rendering path or the transaction destination.
Examples and Use Cases
Implementing detection and prevention for overlay injection rigorously often introduces friction, because stronger anti-tamper checks, stricter overlay policies, and step-up verification can slow legitimate user flows and increase support overhead.
- A mobile banking app displays a convincing “session expired” overlay that captures re-entry of the user’s password and one-time code, then forwards both to the attacker.
- A payment approval screen is replaced by a fake confirmation dialog that causes the victim to authorise a transfer to a fraudulent recipient.
- An Android trojan draws a system-like prompt over a legitimate app to harvest card details during checkout, while the real app remains open in the background.
- An enterprise self-service portal is covered by an overlay that requests credentials and MFA approval, creating a path to account takeover.
- Security teams often assess this pattern together with mobile anti-tamper and runtime integrity controls discussed by the OWASP Mobile Top 10, especially where app manipulation and interface spoofing overlap.
Why It Matters for Security Teams
Overlay injection matters because it undermines trust in the visible interface, which is often the last barrier between an attacker and a high-value action such as credential entry, payment authorisation, or account recovery. Once the user believes an action is genuine, traditional perimeter controls may already be bypassed. This makes the technique especially relevant for identity security, fraud operations, and NHI governance where approval workflows, secrets entry, or delegated access decisions are triggered through apps that assume the screen itself is trustworthy.
For identity and access teams, the key risk is that overlay injection can defeat MFA by harvesting one-time codes or by tricking a user into approving a push prompt or transaction they did not intend to approve. For app and mobile security teams, the issue is often compounded by device compromise, accessibility abuse, or malicious apps with overlay permissions. Guidance from CISA’s anti-phishing guidance and mobile hardening practices is useful, but no single standard fully governs overlay injection as a standalone term. Organisations typically encounter the real business impact only after fraudulent transfers, token theft, or account compromise have already occurred, at which point overlay injection becomes operationally unavoidable to investigate and contain.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-1 | Overlay injection exploits trust in user-facing access paths and approval actions. |
| OWASP Agentic AI Top 10 | User-interface deception can mislead AI assistants and autonomous workflows too. | |
| NIST SP 800-63 | AAL2 | Code-based MFA can be intercepted when overlays capture credentials or OTPs. |
| NIST Zero Trust (SP 800-207) | SA-3 | Zero trust requires continuous verification beyond the visible application screen. |
| OWASP Non-Human Identity Top 10 | Overlay abuse can steal secrets and tokens used by non-human identities. |
Verify that access requests and approvals are authenticated before any transaction is accepted.
