While other malware families have been searching for new overlay techniques for Android 7 and 8, MysteryBot appears to have found a solution.

In 2017 Google removed apps that violated the Google Play policies because they were malicious, purposely copied a more popular app or served up inappropriate content.

Google’s Android security team has turned a corner with 8.0 Oreo, reducing the attack surface, compartmentalizing components and beefing up protection against rogue apps.

Android phones not running the latest Oreo OS are vulnerable to a high-severity “toast” overlay attack.