A screen overlay attack uses a fake interface layered over a legitimate mobile app to capture credentials or other sensitive input. It is often aimed at banking and payment applications, where users expect to enter high-value information. The deception works because the fake screen closely matches the real app experience.
How Screen Overlay Attacks Work
A screen overlay attack abuses the mobile user interface layer rather than the backend service itself. The attacker places a convincing fake screen over a legitimate app, so the victim types sensitive information into the overlay while believing they are interacting with the real application.
The technique is effective because it exploits timing, context and visual trust. In banking and payment flows, users are often conditioned to move quickly through familiar login, transfer or verification screens, which makes a well-matched overlay hard to spot.
Why Screen Overlay Attacks Are Effective
Overlay attacks are a form of deception that converts normal user interaction into credential theft or transaction abuse. They are especially dangerous when the fake UI captures passwords, PINs, card data, one-time codes or approval gestures, because the attacker can reuse that input immediately.
On mobile devices, the attack surface is broader than simple phishing. Malicious apps may rely on accessibility abuse, foreground manipulation, or other device-level tricks to place the overlay at the exact moment the user expects a legitimate prompt. That makes the attack path feel seamless to the victim while hiding the malicious layer.
For a broader view of the mobile malware ecosystem that commonly uses this pattern, see Mobile Malware Guide.
Common Targets and Abuse Patterns
Financial apps are a frequent target because the stolen data has immediate value and can often be used to approve transfers or defeat additional checks. The same method can also target payment apps, wallets, enterprise single sign-on prompts, and mobile apps that reuse familiar brand styling in ways attackers can imitate.
Screen overlay attacks often appear alongside Android banking trojans, SMS interception, and accessibility abuse. The overlay is only one part of the fraud chain, but it is the part the victim sees, which is why it can bypass user suspicion even when the device is already compromised.
For hands-on examples of how this technique is used in financial malware campaigns, Android Banking Trojans Guide explains the overlay pattern in context. Where regional malware families use similar tradecraft, Latin American Banking Trojans Guide shows how the same style of fraud is adapted across endpoint and banking environments.
Defending Against Screen Overlay Attacks
Defence starts with reducing the attacker’s ability to place or persist deceptive UI layers. That means hardening mobile app trust signals, controlling risky permissions, detecting suspicious overlay behaviour, and using platform protections that make it harder for malicious apps to sit above sensitive screens.
Organisations should treat overlays as a user-interface trust problem as much as a malware problem. Banks and app owners need to assume that users can be induced to enter data into the wrong screen, so authentication and transaction flows should be designed to resist imitation, not merely to look familiar.
Detection also matters after the fact. If a user reports an unexpected prompt, failed transaction, or sudden credential reset, the device should be reviewed for malicious apps, accessibility abuse, and other signs that an overlay-capable trojan may have been present.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1113 — Screen Capture | Overlay attacks rely on deceptive UI presentation and credential interception on mobile devices. |
| T1204 — User Execution | The attack depends on convincing the user to interact with a fake interface. | |
| Recommendation — Map suspicious overlay tradecraft to screen capture and user-input deception techniques during mobile threat hunting. Correlate user-triggered app interaction with malicious prompts and deceptive overlays in detections. | ||
| CIS Controls v8 | CIS-10 — Malware Defenses | Mobile overlay attacks are frequently delivered by malware that must be detected and contained. |
| Recommendation — Deploy malware defenses that identify suspicious apps and block known malicious behaviour patterns. | ||
| OWASP ASVS | V6 — Authentication | The term concerns capture of credentials and sensitive input during authentication flows. |
| V7 — Session Management | Stolen input can be used to steal or abuse authenticated sessions after the overlay succeeds. | |
| Recommendation — Harden authentication flows so sensitive entry points resist UI imitation and deception. Protect session handoff and re-authentication paths so captured credentials do not become reusable access. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org