Technique

Overlay Attack

Also known as: Screen Overlay Attack, GUI Input Capture, Phishing Overlay, Activity Hijacking, Window Overlay, Banking Overlay, App Overlay Attack

COMPROMISEMITRE ATT&CK: GUI Input Capture technique (T1417.002) documenting overlay attacks

Malware displays fake login screens over legitimate banking or payment apps to capture credentials.

Common attack flows

How it fits in a scam

This technique shows up duringCOMPROMISE

Before

After

Defense

How to defend against this

How to spot it

  • Review Settings > Apps > Special app access > Display over other apps for unknown apps with overlay permission
  • Unexpected login prompts appearing when banking app not deliberately opened
  • Login screen with different visual styling or subtle differences from normal app UI
  • Apps requesting Accessibility Services or SYSTEM_ALERT_WINDOW permission without clear need
  • Google Play Protect disabled without user action
  • Unusual device lag or battery drain from background overlay monitoring
  • Credential prompts appearing outside normal app workflows

Tools you can use

Steps you can take

Further reading