Tapjacking is a user-interface trick that causes someone to tap a hidden or misleading element instead of the control they intended. On mobile devices, attackers often place a transparent or deceptive layer over a legitimate app so the victim thinks they are confirming one action, while the tap actually approves something else, grants a permission, or launches a malicious feature.
In cyber security, tapjacking matters because it can bypass user judgment rather than code defenses. It is common in Android fraud and malware campaigns that abuse overlays, accessibility services, or fake prompts to steer taps toward banking actions, permission dialogs, or remote-control setup screens. Defenders reduce the risk by blocking screen overlays on sensitive pages, warning on unusual permission requests, and designing apps to detect obscured or non-standard touch input. In practice, tapjacking turns trust in the screen into an attack surface.