There is an Android app called ANeko, which lets a cute cat run around your screen. The app doesn't require any special permissions. When I first started it, I was frightened for several reasons:

  1. It overpaints the home screen and any other screen with its cute cat icon, which I thought was not possible.

  2. The cat even runs around the login screen, which I thought would be a specially protected area.

  3. The ANeko app receives any touch events from any app, although with coordinates (0.0,0.0).

  4. The ANeko app even receives touch events from the login screen.

Now ANeko is only a toy app, and it seems to do exactly what its code on GitHub says. But who knows whether the binary really corresponds to the code?

Are there any legitimate use cases for these features (overpainting, surveilling touch events)?

How can I, as a normal user, protect myself against all touch events being recorded and analyzed? Since even a video of a chips bag can reveal sound recordings, I think that by recording the timing of the touch events, it might be possible to guess the PIN, or passwords, or typical usage patterns.


1 Answer 1


The sort of malware you're referring to is commonly known as overlay malware. Some more specific overlay-related attacks are dubbed "Cloak and Dagger"[1], [2] and "Toast"[3], [4].

Here's a short video (1:02) demonstrating how those work in general (mostly just in the way you've mentioned).

Of course, since in a nutshell the malicious frame is just a window floating on top of other windows, there are a lot of seemingly legitimate applications of that: video calls, navigation, notifications and so on. In fact, your poor old desktop OS is (and has always been) also vulnerable to such an attack once you've installed a malicious application.

One step by Google here has been to remove apps requesting unreasonable overlay permissions from Google Play. Also, since Android 8.0, an explicit permission should be granted by user for an application to be allowed to lay on top of other windows, effectively eliminating most of the attack scenarios.

A patch mitigating the latest reincarnation of the attack, the "Toast", has also been backported to some older versions and is featured in the Android security patchset 2017-09-01 for Android versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 and 7.1.2. Whether or not it makes you feel safer is entirely up to you. However, please note that all the Android versions listed above with patch level lower than 2017-09-01 as well as older versions may be still affected at least to some of the attacks.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .