fraud-overlay-hole-system

Native Windows Forms overlay system that draws a blocking screen or a "hole" form over the victim's desktop or browser window, intercepting mouse and keyboard input while presenting attacker-controlled content (fake login prompts, transaction confirmation dialogs, or progress spinners). Used by LATAM banking trojans to hijack banking sessions in real time.

Technique Details

• Block screen: ShowBlockScreen, ShowBlockScreenWithHtml, ShowTempBlockForm create topmost windows ^[strings.txt]
• Hole form: CreateHoleFormInternal, SetFormHoleWithOptions cut a transparent or clickable "hole" through the overlay so the victim can interact with the real bank page underneath while the attacker controls surrounding elements ^[strings.txt]
• URL monitoring: HoleUrlMonitorLoop polls the browser address bar to trigger overlays on specific banking URLs ^[strings.txt]
• Mouse/keyboard hooks: StartBlockingHooks installs low-level hooks (SetWindowsHookEx) to redirect or suppress input during overlay display ^[strings.txt]

Cross-References

• sky-jamaica — family using this technique
• latam-banking-trojan — broader concept