An Android screen overlay is a layer of content displayed above another app’s interface. It is used for legitimate features such as chat heads, but it can also be abused to obscure trusted screens, intercept interaction, or present a fake login prompt that persuades users to reveal credentials.
What It Is and How It Works
An Android screen overlay is a layer of content drawn above another app, so it can coexist with legitimate features like chat bubbles while also creating a trust problem when abused. Because the overlay can sit on top of a real interface, users may interact with what looks like a normal app while actually tapping attacker-controlled content.
On Android, the security significance is not the visual layer itself but the authority it can borrow from the underlying app. That makes overlays especially useful for deception, because the user’s attention is directed to the foreground while the real target remains partially hidden behind it.
Why Overlays Are Abused
Attackers use overlays to obscure warnings, cover security prompts, or present a fake login screen that resembles a trusted app. The technique is effective because it exploits user expectations, not just software flaws, and can turn a legitimate interaction into credential theft or consent abuse.
In practice, overlay abuse often appears alongside other on-device fraud techniques such as accessibility misuse or SMS interception. The overlay is the visible deception layer, while the broader attack may be aimed at capturing passwords, one-time codes, or approvals before the user realises the screen has been manipulated.
Legitimate Uses and Security Trade-Offs
Not every overlay is malicious. Messaging heads, floating controls, assistive tools, and some productivity features rely on overlay-style presentation because they need to stay accessible across apps. The trade-off is that the same usability benefit can become a security liability if an app is allowed to draw over sensitive screens without strong user awareness or platform restriction.
That is why overlay permissions are sensitive in mobile security design. The more broadly an app can draw over other apps, the more carefully it must be limited, reviewed, and explained to users, especially when it can appear during authentication, payment, or permission-grant flows.
How Defenders Spot and Reduce Exposure
Defenders look for suspicious overlay behaviour by reviewing which apps can present over other apps, watching for screens that change unexpectedly during login or payment, and checking whether the overlay is paired with other fraud indicators. A suspicious overlay is often one that appears only when a high-value action is underway and disappears as soon as the user navigates away.
Reducing exposure usually means narrowing the set of apps allowed to overlay sensitive screens, limiting interaction on top of trust-critical interfaces, and training users to treat unexpected visual changes during authentication as suspicious. For a deeper view of how overlays are used in Android fraud campaigns and the controls that matter most, see Android Banking Trojans Guide.
Risk and Threat Considerations
Screen overlays create a deception path that can hide trusted UI, capture credentials, or steer users into authorising the wrong action. The risk is highest when an overlay appears during sign-in, banking, or approval flows, because the user may believe they are interacting with the genuine app while the attacker controls what is shown on top.
Failure mechanism: The attacker places a fake or obscuring layer above a legitimate screen, then waits for the user to enter secrets or approve actions into the wrong interface.
Impact: Credentials, session material, payment approvals, or other sensitive actions can be stolen or misused, leading to account compromise and on-device fraud.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Limits app capabilities that can interfere with sensitive user interactions. |
| IA-5 — Authenticator Management | Covers protection of credentials that overlays may steal from login flows. | |
| Recommendation — Restrict overlay-capable apps to the minimum permissions needed for their function. Protect, rotate, and monitor credentials exposed to overlay-based phishing. | ||
| CIS Controls v8 | CIS-5 — Account Management | Supports control of high-risk app and account interactions on endpoints. |
| Recommendation — Review privileged and sensitive accounts for exposure to deceptive mobile interactions. | ||
| MITRE ATT&CK | T1036 — Masquerading | Overlay abuse commonly disguises malicious UI as trusted application content. |
| T1056 — Input Capture | Fake overlays are often used to capture credentials or other user input. | |
| Recommendation — Map overlay-based deception to masquerading and hunt for UI impersonation activity. Correlate overlay events with suspicious input-capture behaviour. | ||
Practitioner Guidance
Why practitioners should care: Overlay abuse is less about visual trickery and more about trust boundary failure. If a sensitive screen can be obscured at the moment a user is making a security decision, the app has lost control of the interaction context.
What to watch for: Pay special attention to overlays that appear only during authentication, password resets, permissions, or financial actions, because that pattern often indicates deliberate deception rather than benign UI enhancement.
Practitioner takeaway: Treat overlay capability as a high-risk UI privilege and evaluate it alongside the screens it can cover, not just the feature that requested it.
Related resources from NHI Mgmt Group
- What breaks when Android overlay protection is not in place?
- What is the difference between overlay attacks and activity injection on Android?
- Why can password protection still fail in Android 15 even when the platform adds screen spying defenses?
- What are the signs that Android 15 screen spying controls are being bypassed in practice?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org