Activity injection

A technique in which an attacker places or launches an activity over a victim app to alter what the user sees or how the victim app behaves. In this context, it can help create conditions for pixel theft or suppress visibility of defensive UI behaviour, making lifecycle-aware controls important.

Expanded Definition

Activity injection is a user-interface attack pattern in which malicious code, automation, or an overlaid component drives activity inside a victim app so the attacker can change what the user perceives or how the app behaves. In agentic and NHI-adjacent systems, the risk is not limited to visual deception: injected activity can redirect workflows, suppress warnings, or trigger privileged operations through a trusted session. The concept overlaps with UI redressing, overlay abuse, and event hijacking, but definitions vary across vendors because some treat it as a presentation-layer attack while others classify it by the control path that was manipulated. For security teams, the key question is whether the injected activity can inherit trust from the victim app or from an authenticated user session, especially where sensitive actions are completed through mobile, browser, or desktop automation. NIST’s control language around access enforcement and monitoring is useful here, especially when paired with NIST SP 800-53 Rev 5 Security and Privacy Controls and lifecycle governance guidance in the Ultimate Guide to NHIs. The most common misapplication is treating activity injection as a generic malware issue, which occurs when defenders fail to inspect how the attacker exploits the app’s own trusted interaction flow.

Examples and Use Cases

Implementing controls against activity injection rigorously often introduces friction, requiring organisations to balance stronger interaction verification against lower user experience and more complex testing.

• A malicious overlay captures taps in a mobile admin app and sends them to a hidden approval flow, allowing an attacker to alter a high-risk action without changing the backend.
• An injected automation script suppresses defensive prompts in a browser-based console, making a compromised NHI session appear normal while it executes privileged requests.
• A desktop helper or plugin launches activity in the foreground application and rides the user’s trust boundary, which can be especially dangerous when secrets or tokens are copied and pasted during incident response.
• A workflow agent is induced to open or submit an action from within a trusted interface, showing how activity injection can intersect with agentic execution authority and tool access.
• For broader context on compromised identities and control gaps, NHI leaders often pair app-layer review with the Ultimate Guide to NHIs and validate logging expectations against NIST SP 800-53 Rev 5 Security and Privacy Controls.

Why It Matters in NHI Security

Activity injection matters because it can turn an otherwise legitimate NHI or agent session into an untrusted control path without visibly breaking authentication. That makes traditional perimeter checks insufficient: the attack occurs after login, inside the experience where approvers, operators, or automation runners expect the interface itself to be trustworthy. In NHI environments, this can lead to token misuse, unauthorized approvals, hidden configuration changes, or silent suppression of alerts that should have interrupted an action. It is especially important in low-visibility estates, where only 5.7% of organisations have full visibility into their service accounts, and attackers can combine UI manipulation with overprivileged identities to amplify damage. The broader NHI governance lesson is that identity strength alone does not prevent trust-boundary abuse; controls must also validate how actions are initiated, displayed, and confirmed. NHI Management Group’s Ultimate Guide to NHIs notes that 97% of NHIs carry excessive privileges, which makes any injected activity more consequential once a session is hijacked. Organisations typically encounter the operational impact only after a suspicious approval, unexpected API call, or altered workflow appears in logs, at which point activity injection becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What is credential injection risk and how does it occur?
• What is the difference between prompt injection risk and identity abuse in agents?
• How should security teams monitor AI agent activity without disrupting developers?
• How can SOC teams use identity context to improve response to agent activity?