GUI Input Capture is a mobile attack pattern where malware steals what a user types by manipulating the interface instead of breaking encryption. Common methods include fake login screens, invisible overlays, focus hijacking, and abuse of accessibility features. The victim believes they are entering a PIN, password, or one-time code into a legitimate app, while the malicious layer records the input or forwards it to an attacker. This matters because it defeats defenses that only protect stored data or network traffic: the secret is taken at the moment it is entered.
In Android fraud campaigns, GUI Input Capture is often seen in banking trojans and phishing frameworks that target financial apps. Defenders reduce the risk by blocking overlays on sensitive screens with controls such as HIDE_OVERLAY_WINDOWS, reviewing dangerous permissions, watching for suspicious accessibility-service use, and adding device-risk signals to login and transaction checks. The practical lesson is that the screen is part of the attack surface, so session trust depends on more than a correct password or PIN.