Android Overlay Attack is a mobile attack technique that places a malicious window or screen element over a legitimate Android app interface. It is used to steal credentials, intercept taps, or trick users into approving actions by making the fake layer look like the real one.
How an Android Overlay Attack Works
An Android overlay attack abuses the device’s UI layer by drawing a fake screen, permission prompt, or login form on top of a legitimate app. The user believes they are interacting with the real application, while the attacker captures taps, credentials, or approval actions.
This is dangerous because the malicious layer can make a trustworthy app look unchanged while silently redirecting the user’s input. Overlay abuse is often paired with banking trojans and other mobile malware that already have a foothold on the device.
Why Overlay Attacks Are Effective on Android
The attack succeeds by exploiting attention and timing, not just code execution. If the overlay is visually convincing and appears at the right moment, the user may enter a password, approve a transfer, or grant permissions without recognising the deception.
Android environments can be especially exposed when users install sideloaded apps, grant accessibility-related permissions, or ignore warnings about unknown app behaviour. Those conditions give malicious software more opportunities to present an overlay or to keep it on screen long enough to harvest input.
Common Abuse Patterns and Related Mobile Threats
Overlay attacks are frequently seen in mobile fraud campaigns that target banking and payment apps. Attackers may impersonate a login screen, a security challenge, or a transaction confirmation page, then use the captured information immediately or pass it to a separate fraud workflow.
The technique often overlaps with other mobile abuse patterns such as accessibility-service abuse, SMS interception, and app impersonation. Mobile Malware Guide is a useful companion reference because it places overlay abuse in the broader context of Android malware families and user-evasion techniques.
Android Banking Trojans Guide is especially relevant where overlays are used for on-device fraud, because it explains how banking malware combines fake UI layers with credential theft and transaction manipulation.
Detection and Defensive Controls
Defending against overlay attacks depends on both device hardening and user-facing controls. Organisations should reduce the conditions that let untrusted apps draw over other apps, restrict risky permission combinations, and use mobile security tooling to flag suspicious behaviour such as unexpected screen overlays or accessibility abuse.
Where mobile threat detection is part of the control stack, defenders should look for patterns that indicate a hidden or persistent malicious interface, especially when a banking or authentication app is active. MITRE ATT&CK for Mobile Guide helps map those behaviours to mobile tactics and mitigations so teams can connect the user-facing symptom to a real attack path.
For organisations that need external threat context, CISA cyber threat advisories provide authoritative guidance on active mobile and credential-stealing threat patterns that may be relevant when overlay abuse is part of a broader campaign.
Defenders should also review app design choices that make approval flows too easy to spoof. Strong session binding, transaction verification, and out-of-band confirmation reduce the value of a fake screen even when a malicious overlay is present.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while OWASP ASVS, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V6 — Authentication | Android overlay attacks target login prompts and credential entry flows. |
| V7 — Session Management | Overlays are used to steal or misuse active sessions and approvals. | |
| Recommendation — Harden authentication flows so overlays cannot easily spoof login or approval steps. Bind sensitive actions to secure session checks and revalidation prompts. | ||
| MITRE ATT&CK | T1218 — Signed Binary Proxy Execution | Mobile malware often uses trusted-looking apps and execution paths to deliver overlays. |
| Recommendation — Map suspicious mobile execution chains to ATT&CK and hunt for trusted-process abuse. | ||
| CIS Controls v8 | CIS-9 — Email and Web Browser Protections | User-driven mobile malware delivery often begins through deceptive links and downloads. |
| Recommendation — Block deceptive delivery paths and restrict risky user installation behavior. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Overlay attacks aim to capture authentication events and credentials. |
| Recommendation — Strengthen user authentication steps so fake screens cannot complete sign-in. | ||