<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-mobile-overlay-attacks
description: >-
  Detect and analyze mobile overlay attacks including tapjacking, activity
  hijacking, and UI redressing on Android through permission analysis,
  WindowManager hooking, accessibility service monitoring, and runtime
  behavioral analysis using Frida and static code review.
domain: cybersecurity
subdomain: mobile-security
tags:
  - overlay-attack
  - tapjacking
  - activity-hijacking
  - ui-redressing
  - accessibility-abuse
  - frida
  - android
  - windowmanager
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1411", "T1626.001"]
  owasp-mobile: ["M1", "M8"]
  tools: ["frida", "apktool", "jadx", "adb", "drozer"]
---

# Detecting Mobile Overlay Attacks

## Overview

Overlay attacks draw deceptive UI elements on top of legitimate apps to steal
credentials, trick users into granting permissions, or intercept taps. Android's
SYSTEM_ALERT_WINDOW permission enables floating windows, while accessibility
services can programmatically interact with any app. Banking trojans, adware,
and permission-harvesting malware heavily use overlay techniques.

## Prerequisites

```bash
pip install frida-tools androguard
apt install apktool adb
# drozer: pip install drozer
# jadx: https://github.com/skylot/jadx/releases
```

## Workflow

### Step 1: Permission and Manifest Analysis

```bash
# Check for overlay permissions
apktool d suspect.apk -o apktool_out/
grep -E 'SYSTEM_ALERT_WINDOW|TYPE_APPLICATION_OVERLAY' apktool_out/AndroidManifest.xml

# Check for accessibility service declaration
grep -A10 'AccessibilityService' apktool_out/AndroidManifest.xml
cat apktool_out/res/xml/accessibility_service_config.xml 2>/dev/null

# Check targetSdkVersion — older SDK allows overlay without permission
grep -E 'targetSdkVersion|platformBuildVersionCode' apktool_out/apktool.yml

# List apps with draw-over-other-apps permission
adb shell appops query-op SYSTEM_ALERT_WINDOW allow
```

### Step 2: Static Overlay Code Analysis

```bash
# Decompile and search for overlay implementation
jadx -d jadx_out/ suspect.apk --deobf

# WindowManager overlay creation
grep -rn 'TYPE_APPLICATION_OVERLAY\|TYPE_SYSTEM_ALERT\|TYPE_PHONE' jadx_out/
grep -rn 'WindowManager.LayoutParams\|addView.*LayoutParams' jadx_out/

# Check overlay flags — FLAG_NOT_TOUCHABLE allows tapjacking
grep -rn 'FLAG_NOT_TOUCHABLE\|FLAG_NOT_FOCUSABLE\|FLAG_WATCH_OUTSIDE_TOUCH' jadx_out/

# Activity task hijacking patterns
grep -rn 'FLAG_ACTIVITY_NEW_TASK\|taskAffinity\|allowTaskReparenting' jadx_out/
grep -rn 'taskAffinity' apktool_out/AndroidManifest.xml

# Accessibility event interception
grep -rn 'onAccessibilityEvent\|performAction\|findAccessibilityNodeInfo' jadx_out/
grep -rn 'TYPE_WINDOW_STATE_CHANGED\|TYPE_VIEW_FOCUSED' jadx_out/
```

### Step 3: Runtime Overlay Detection with Frida

```bash
# Hook WindowManager.addView to detect overlay creation
frida -U -f com.suspect.app -l detect_overlay.js --no-pause

# Monitor foreground activity changes
frida -U -f com.suspect.app -l monitor_activity.js --no-pause

# Hook accessibility service to monitor injected events
frida -U -f com.suspect.app -l hook_accessibility.js --no-pause

# Detect overlay drawing over specific target apps
adb shell dumpsys window | grep -E 'mSurface|mOwnerPid'
```

### Step 4: Tapjacking Verification

```bash
# Check if target app has tapjacking protection
grep -rn 'filterTouchesWhenObscured\|setFilterTouchesWhenObscured' jadx_out/
# If not found → target app is vulnerable to tapjacking

# Check layout XML for filterTouchesWhenObscured
grep -rn 'filterTouchesWhenObscured' apktool_out/res/layout/

# Runtime test — draw transparent overlay and verify touch passthrough
# Use Frida to create test overlay
frida -U -f com.target.app -l tapjack_test.js --no-pause

# ADB test — verify FLAG_WINDOW_IS_OBSCURED in MotionEvent
adb shell input tap 500 500  # while overlay is active
```

### Step 5: Activity Hijacking Detection

```bash
# Check for task affinity abuse
grep -rn 'taskAffinity=""' apktool_out/AndroidManifest.xml  # empty = hijackable

# drozer activity enumeration
drozer console connect
# run app.activity.info -a com.suspect
# run app.activity.start --component com.suspect com.suspect.FakeLoginActivity

# Monitor task stack
adb shell dumpsys activity activities | grep -A5 'TaskRecord'
adb shell dumpsys activity recents

# Frida — hook startActivity to detect hijacking attempts
frida -U -f com.suspect.app -l hook_start_activity.js --no-pause
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| SYSTEM_ALERT_WINDOW | Manifest | Overlay permission requested |
| TYPE_APPLICATION_OVERLAY | Code | Overlay window type in code |
| Accessibility abuse | Service config | Broad event types monitored |
| No tapjack protection | Layout/code | Missing filterTouchesWhenObscured |
| Task affinity abuse | Manifest | Empty or matching taskAffinity |
| Overlay timing | Runtime | Overlay appears when banking app opens |

```yaml
title: Mobile Overlay Attacks Detection
id: 0a15030f-d51e-4bb0-99d1-0b53fec983e2
status: experimental
description: Detects suspicious activity related to detecting mobile overlay attacks techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1411
  - attack.t1626.001
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies
```

## Verification

- [ ] Overlay permission and manifest flags audited
- [ ] Static analysis of overlay creation code completed
- [ ] Runtime overlay detection via Frida confirmed
- [ ] Tapjacking protection assessed on target apps
- [ ] Activity hijacking vectors identified
- [ ] Accessibility service abuse patterns cataloged

## References

- [Android Overlay Attack Docs](https://developer.android.com/reference/android/Manifest.permission#SYSTEM_ALERT_WINDOW)
- [MITRE T1626.001 — Abuse Elevation Control (Tapjacking)](https://attack.mitre.org/techniques/T1626/001/)
- [OWASP MASTG — Platform Interaction](https://mas.owasp.org/MASTG/)
- [Android Tapjacking Protection](https://developer.android.com/reference/android/view/View#security)
