TapTrap: Animation-Driven Tapjacking on Android

Philipp Beer, Marco Squarcina, Sebastian Roth, Martina Lindorfer

34th USENIX Security Symposium · Day 1

"TapTrap: Animation-Driven Tapjacking on Android" introduces a novel and stealthy attack vector that exploits Android's activity transition animations to circumvent the platform's permission model and existing tapjacking defenses. Developed by researchers Philipp Beer, Marco Squarcina, Sebastian Roth, and Martina Lindorfer, TapTrap demonstrates how a zero-permission malicious application can trick users into performing unintended, sensitive actions by manipulating the visual presentation of the user interface during activity transitions. This fundamental shift from traditional overlay-based tapjacking techniques allows TapTrap to remain effective even on the latest Android 15, presenting a significant security challenge.

AI review

Solid research that found a genuinely novel attack primitive hiding in plain sight. Activity transition animations as a tapjacking vector is clever, the 76% vulnerable apps number is damning, and the user study confirms what we all suspected: users don't notice shit even when you warn them. Not a 5 because the attack window constraints and side-channel detection requirements limit practical exploitation.