Los ataques de superposición están agotando las cuentas: por qué tu aplicación móvil necesita protección de aplicaciones. 

Mobile banking malware is a growing challenge for financial institutions and consumers. Kaspersky detected 255,090 new mobile banking trojan packages in 2025. Mobile banking users are seeing fraud on their accounts and the fraud losses, support costs and eroded trust land on the brand whose app was attacked by fraud organizations and nation states. Fraud takes many forms, but with the increase in AI capabilities a common and large scaling approach is harvesting user credentials with an overlay attack. 

How an overlay attack works 

It’s a simple technique, and a cruel one: attackers hijack a feature built to help people with disabilities and turn it into a weapon against everyone else. Android’s accessibility service exists to make phones usable for people who can’t easily see, hear, or touch a screen the way others do. Malware abuses that same trust to watch what’s happening on a victim’s device. The victim is usually tricked into sideloading the malware first, disguised as an innocent app, planted on a shady third-party store, through malicious links or social media ads. But the real damage starts once the app asks the user to enable accessibility service in settings and the user, not knowing any better, grants it. From that moment, the malware can capture input and monitor applications to carry out the rest of the attack chain. Overlays can exist without accessibility services, but this component combined with intercepting one-time passcodes makes the full attack chain much simpler.  

When the victim opens a targeted banking app, the malware draws a pixel-perfect fake login screen on top of it. The user enters their credentials into the attacker’s page, and the credentials are sent off to the malicious actors. Sometimes the malware will also enter the credentials into the real app so the user never knows. There are many documented cases of this kind of malware spread across the entire world. Just a few are described below. 

Different threat actors, same playbook 

Overlay malware is a mature market. A few recent examples: 

• GoldFactory (Gigabud, GoldKefu, GoldPickAxe): shows a fake login screen over the real banking app, plus an invisible overlay that captures the phone’s lock-screen code. It also clones target apps into a managed profile to evade signature-based detection. The group is focused on Asia-Pacific but is also present in the Middle East, Africa and Latin America. group-ib 

• RemControl: more than 30 confirmed overlay application targets across western Europe, the Middle East, and Canada. group-ib 

• Sturnus: keeps a library of per-app HTML phishing templates, aimed at financial institutions in southern and central Europe. threatfabric 

• Massiv: shows a fake overlay whenever a targeted app launches, and spreads through fake IPTV apps. Those lures have been seen in southern Europe. threatfabric 

• ToxicPanda 2.0: supports phishing overlays and targets 349 banking, financial, e-wallet and crypto apps for credential theft across Europe. zimperio 

• OverlayPhantom: distributed through malicious URLs, it uses accessibility services to gain escalated permissions and overlays to harvest credentials from more than 180 applications in the United States, Australia, Germany, France, Belgium, Finland, the Netherlands, Italy, Spain and the United Kingdom. cyble 

The names change, but the pattern holds: a convincing lure, often an Accessibility permission, and a fake overlay screen over the victim application. Credential harvesting malware targeting Android financial services applications is seen across the globe, and any mobile banking app installed on an infected device is a potential target. These examples also have significantly more capability than just providing an overlay, but overlays remain a straightforward mechanism to harvest user credentials. 

Attackers are going after the app’s own defenses 

Overlay detection is necessary to protect the end users from these kinds of malware, but attackers know how apps try to defend themselves, and they are adapting. A newer example is Hirudo, documented by ThreatFabric this month. Instead of only drawing overlays, it replaces the genuine banking app with a patched copy. That copy carries a hooking engine designed to blind the app’s signature checks, accessibility checks, screen-capture checks, and Play Integrity checks from inside. Hirudo is mainly observed in Asia, but the techniques used show an advancement in threat capabilities. This threat requires defense in depth to protect against application tampering and application cloning. 

The lesson is that a single overlay check is not enough. Apps need protection from overlay attacks and need layered protection that is difficult to find, difficult to disable and difficult to fake. 

How Arxan Security delivers Application Defense 

Application Defense means the app protects itself at runtime, wherever it is installed, including devices you don’t control. Arxan Security from Digital.ai applies that approach to mobile apps in several layers: 

• Directly detecting or preventing common malware controls: overlay prevention/detection, accessibility service detection, and virtual control detection to directly protect against the techniques these types of malware use to harvest user credentials. 

• Anti-tamper and integrity monitoring: the app monitors and responds to code modifications, and the tools used by threat actors to reverse engineer and modify applications. 

• Visibility for fraud teams: real-time alerting through Threat Monitoring when and how apps are being attacked in production. 

• Static Analysis protection: obfuscation, encryption, and capabilities that confuse AI reverse engineering that leads to the development of advanced attacks. 

 See how well your application is protected 

Overlay malware and AI reverse engineering threats are regularly attacking apps anywhere they can be accessed. Get an AI Resilience score, a 0-100 assessment of how well your app hides its code, resists tampering, and defends against runtime attacks. See what’s exposing you and what to fix first, before an attacker finds it. Go to https://digital.ai/ai-threat-assessment/ y regístrate.