Screen hijacking is malware behavior that interferes with what a user sees on the screen to mislead them. The attacker may overlay fake windows, hide the real interface, or alter visible prompts so the victim thinks they are interacting with a trusted application. This matters because security decisions often depend on what users can see and verify in the moment.
In real attacks, screen hijacking is often used to capture passwords, approve actions, or steer victims into entering sensitive data into a fake form. It can also help malware conceal other activity while the user focuses on a manipulated display. Defenders look for unusual window behavior, focus changes, and mismatches between visible content and backend activity, along with stronger authentication methods that do not rely only on what appears on screen.