Dangerous Ransomware Technique

> In the beginning, the malicious app is started by the user. The app creates a full screen view in the foreground. A view is a rectangular area on the screen which is responsible for event handling and drawing. Additionally, it contains UI components such as buttons and text fields [13]. The malicious app opens the preinstalled Google Play Store app in the background. The view of the malicious app overlays the opened Google Play Store app. As a result, the user does not notice that the Google Play Store app is opened. The chargeable app of the attacker is selected in the Google Play Store app. Furthermore, the Google Play Store app contains the button Buy for 50 $.

Is this even possible? Android allows developers to "launch" other applications "behind" the foreground app, and click events actually make it back down to the target app? I find this hard to believe.

While this is a pretty cool abuse of the Windows APIs, it seems to me from a first reading that it's not very "dangerous" compared to existing techniques for malware and ransomware to hide their activity. While the user imitating technique seems to have succeeded against typical anti-ransomware methods in a wide slate of antivirus products, these products already fail to detect and stop most actual ransomware in the wild. This is just another way to get around antivirus, and definitely one of the more complicated ones. And the user-imitating technique doesn't help against more advanced antivirus and EDR that analyzes the process tree and would immediately flag the wacky stuff they're doing with cmd.exe.

This is not specific to ransomware. The title of the paper is

Phantom Malware: Conceal Malicious Actions From Malware Detection Techniques by Imitating User Activity Publisher