RatHat WebView overlay injection atop foregrounded banking apps

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•2

This rule detects the presence of unauthorized WebView or HTML overlay windows rendered on top of active banking applications on Android devices. This behavior is indicative of credential-theft malware, such as banking trojans, which use overlays to capture user input, including banking credentials, while masking their activity over legitimate finance-related applications.