An Android app uses the SYSTEM_ALERT_WINDOW permission to draw a fake bank login screen over the legitimate banking app whenever the banking app is detected in the foreground. What is this attack technique called?

Why C is correct

An overlay attack uses the SYSTEM_ALERT_WINDOW permission (or TYPE_APPLICATION_OVERLAY on Android 8+) to draw a malicious UI layer over a legitimate app. The victim believes they are interacting with the real app while credentials are captured by the malware. Tapjacking is a related but distinct attack where invisible overlays intercept touch events. Accessibility service theft involves reading screen content rather than overlaying UI. Deep link hijacking intercepts app-to-app navigation intents.