An app overlay attack places a fake interface on top of a legitimate mobile app to capture credentials or other sensitive input. The user believes they are interacting with the real application, while the malware silently harvests usernames, passwords, or financial data in the background.
What the attack does
An app overlay attack abuses the user interface layer rather than the backend service. The malware displays a convincing counterfeit screen on top of a legitimate mobile app, then captures what the user types before that input reaches the real application.
This technique is effective because users tend to trust the visible app context, especially during login, payment, or account recovery flows. The real danger is not just credential theft, but the ability to harvest high-value data at the moment of entry, while the victim sees a normal app experience.
Why it works on mobile devices
Overlay attacks depend on the operating system’s permission model, foreground app switching, and the user’s inability to easily distinguish a genuine screen from a fake one. On some devices, malicious apps can request accessibility or display-related permissions that make UI abuse easier.
The attack often succeeds when the victim has already launched a trusted app and is expecting to authenticate or approve a transaction. That timing reduces suspicion and increases the chance that the overlay will be accepted as part of the legitimate workflow.
What attackers usually target
Credential entry is the most common target, but overlays can also capture one-time passcodes, card data, personal details, and recovery information. If the attacker obtains login material, the next step is often account takeover, payment fraud, or lateral abuse of connected services.
Because overlays sit in front of the real interface, they can also be used to suppress warning messages, redirect users, or manipulate the sequence of taps. That makes them useful in phishing-like campaigns where the goal is to turn a single successful interaction into broader compromise.
How defenders should think about it
App overlay attack is best understood as a user-interface deception problem with downstream identity and fraud consequences. Mobile security teams should treat it as a signal that the endpoint may be hostile, the app flow may be impersonated, or the authentication experience may be vulnerable to real-time capture.
Defenses become stronger when apps validate the execution environment, reduce dependence on typed secrets, and use phishing-resistant authentication where possible. The more a workflow relies on visible trust in the screen, the more attractive it becomes to overlay-based abuse.
Risk and Threat Considerations
Overlay attacks can turn an otherwise legitimate mobile login or payment flow into an interception point for credentials and transaction data. The risk is highest where users enter secrets, approval codes, or sensitive personal details in a predictable sequence that malware can imitate.
Failure mechanism: A malicious app or abusive permission model places a counterfeit interface above the real app, captures typed input, and may hide the victim’s view of the genuine prompt or alert.
Impact: Stolen credentials, account takeover, fraudulent transactions, and unauthorized access can follow, especially when the captured data is reusable beyond the original session.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, OWASP ASVS, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Overlay attacks steal user credentials during login flows. |
| IA-5 — Authenticator Management | Overlays often harvest passwords, OTPs, and other authenticators. | |
| Recommendation — Use IA-2 to strengthen user authentication against captured credentials. Use IA-5 to limit secret reuse and manage authenticators tightly. | ||
| OWASP ASVS | V6 — Authentication | Overlay attacks target the user-facing authentication step in apps. |
| V7 — Session Management | Captured credentials or approvals can be used to hijack sessions. | |
| Recommendation — Apply V6 to harden app authentication flows against input capture. Apply V7 to reduce session abuse after credential theft. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Captured secrets can enable unauthorized access that must be controlled. |
| Recommendation — Use CIS-6 to restrict and review access paths exposed by stolen input. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Proofing, Authentication, and Binding | The attack exploits weak user authentication and trust in login prompts. |
| Recommendation — Use PR.AA-05 to bind authentication more tightly to the real user and device. | ||
| MITRE ATT&CK | T1056.001 — Keylogging | Overlay attacks capture keystrokes or sensitive input through deceptive UI. |
| Recommendation — Map observed input capture to T1056.001 and hunt for credential theft behavior. | ||
Practitioner Guidance
What to watch for: Treat unexpected UI interference, suspicious permission requests, and repeated login failures as indicators that the device or app flow may be under overlay abuse. Where the business impact is high, prefer authentication methods that are harder to reuse from captured input alone.
Governance implication: Mobile app owners should assume that visual trust is insufficient on its own. Security review should cover how the app handles sensitive input, how much it relies on typed secrets, and whether the user journey can be hardened against deceptive overlays.
Related resources from NHI Mgmt Group
- Attack Surface Management
- Why does outbound traffic to restricted geographies create compliance risk even when the app is not under attack?
- How should app teams reduce identity attack risk when multiple login methods can attach to the same account?
- Why does partial code obfuscation sometimes make an app easier to attack?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 25, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
