A sensitive Android flow resists deceptive overlays when it knows three things at the moment of a tap: that its own screen is the one in front of the customer, that the touch did not pass through another app’s window, and that no foreign screen has been slipped into its task. Otukan checks all three on the screens you mark as protected, pauses or ignores the tap when something is wrong and reports the event to your backend. It builds on the defences newer Android releases provide and adds its own checks where older releases leave a gap. Chat heads, screen filters and assistive tools are tested and allowed.
Threat distinction
“Overlay attack” covers three techniques. They need different checks, so Otukan keeps them apart.
Malicious overlays
Malware with permission to display over other apps waits for your app to open, then draws a copy of your login or card screen on top. The customer types into the copy. Otukan notices that your real screen has lost focus to a window drawn by another app while it should be receiving input.
Obscured touches
Tapjacking works the other way round. A harmless-looking window covers your screen, and the customer’s tap passes through to a button underneath, often approve or allow. Android marks touches that pass through another window; Otukan reads that evidence on every protected button.
Activity injection
Instead of drawing over your app, the attacker places its own screen inside your app’s task, so the back button and recent-apps view make it look like yours. Otukan hardens your task configuration and checks, when a sensitive flow resumes, that the screen in front of the customer belongs to your app.
| Technique | What the customer sees | Otukan’s check |
|---|---|---|
| Malicious overlay | A convincing copy of your screen | Focus loss to another app’s window |
| Tapjacking | A harmless screen hiding yours | Obscured-touch evidence on protected controls |
| Activity injection | A foreign screen inside your app’s flow | Task integrity on resume |
Platform support
Android’s own defences have grown stronger over successive releases, but customers carry a wide mix of versions and manufacturer builds. Otukan layers its checks so the same protected screen behaves consistently across them.
| Control | Newer Android releases | Older Android releases |
|---|---|---|
| Untrusted touches through overlays | Blocked by the system in many cases; Otukan confirms and reports | Otukan’s obscured-touch checks decide |
| Hiding non-system windows | Otukan asks the system to hide them on protected screens | Otukan detects the overlay and pauses input |
| Task injection | Otukan’s task hardening and resume checks | Task hardening and resume checks, tested against older task-switching behaviour |
| Manufacturer variation | Tested per maker on physical devices | Tested per maker on physical devices |
Framework apps need the same care. A Flutter or React Native screen still runs inside an Android activity, so Otukan applies the checks at that level and confirms them on the protected screens your framework renders.
System windows, such as the notification shade or a phone call screen, sit outside any app’s control and are expected. Otukan does not treat them as attacks, and a protected screen behind them simply waits until they close. For the wider Android picture, see Android app security.
Usability
Plenty of honest apps draw over others. The protection should notice them without punishing the people who use them.
Chat heads and floating tools
Messaging bubbles, floating video players, screen dimmers and blue-light filters all create windows above your app. Otukan checks only on protected screens and only at the moment of a sensitive tap. When a harmless window is in the way, the customer is asked to move or close it, then carries on.
Assistive tools
Some accessibility tools add floating controls or magnifiers. They are part of Otukan’s test baseline, so customers who depend on them are not blocked. Where an accessibility service also reads or taps the screen, accessibility abuse detection handles it.
Tested on real devices
Every protected screen is tested in an authorised lab with an overlay, a tapjacking window and an injected activity, then with the legitimate-window baseline, then through install, update, sign-in and approval. Devices, Android versions, expected results and the reviewer are recorded.
Overlay defence is one part of mobile fraud prevention, which covers the related controls.