MediaProjection is an Android API that lets an app capture what is shown on the device screen, but only after the user approves the permission prompt. It is intended for legitimate tasks such as screen sharing, remote support, recording, and accessibility tools.
In cyber security, MediaProjection matters because malware can abuse it to watch banking apps, steal one-time codes, or record sensitive on-screen activity without needing full system compromise. Attackers often pair it with Accessibility abuse to automate taps and keep control of the interface. Defenders should treat unexpected screen-capture prompts as high-risk, especially in sideloaded apps or apps with no clear need to record the display. Monitoring for unusual consent requests and restricting risky app installs can reduce exposure.