This new Android attack could trick you into compromising your own phone — everything you need to know

Tapping the wrong part of the screen on one of the best Android phones could leave you and your device completely vulnerable to hackers.

A team of security researchers at TU Wien and the University of Bayreuth have published a paper detailing their new TapTrap attack technique. Surprisingly, it's capable of bypassing Android’s permission system in order to access sensitive information and deceive users into clicking buttons that will perform malicious actions.

As reported by Bleeping Computer, the animations for TapTrap are enabled unless the user disables them from the developer options or accessibility settings.

The TapTrap attack is a tapjacking technique, which relies on an invisible UI trick to work. It creates a disparity between what the user sees on their screen and what the device registers because it changes the way that the operating system handles activity transitions with custom animations.

Basically, TapTrap overlays an animation on top of a harmless app – essentially launching an invisible, malicious image on top of a legitimate regularly functioning action.

Users who believe they’re interacting with a normal app may tap on buttons that say “allow” or “authorize” on screen positions that correspond to risk actions because they're overlayed on invisible prompts. This could potentially even convince a user to wipe a device by mistake and to make matters worse, it works with zero-permission apps.

The researchers used the animations in Android 15 while the technique was in development, and additionally ran some testing on Android 16 afterwards. This confirmed that TapTrap can run on both of the latest versions of Google's operating system. They also looking at nearly 100,000 different apps in the Google Play Store to determine if the attack would work with them too.

Of those, 76% were found to be vulnerable to TapTrap because they fit the criteria (included a screen that could be launched by another app, that runs in the same task, does not override the transition animation, and does not wait for the animation to finish before it reacts to input).

Fortunately though, TapTrap was created by security researchers and not hackers, so it isn't the kind of pressing threat you need to watch out for like dangerous malware.

Still, it shows how an enterprising hacker could bypass Android's permissions system to trick unsuspecting users into compromising their own devices or inadvertently giving cybercriminals access to their data.

More from Tom's Guide

• Best Prime Day antivirus deals: 7 heavily discounted security suites to keep you safe online
• Nearly 2 million people hit by malicious Chrome installations that can track you — what to do now
• This dangerous banking trojan now uses scheduled maintenance to hide its malicious activities — don’t fall for this