Can Screen Overlay Tools Be Detected by Interviewers?

By Vaibhav Devere, Founder, Zero Assist · 2025-05-08 · 6 min read

What Are Screen Overlay Tools

Screen overlay tools are a class of cheating applications that display information on top of the candidate's normal screen content without appearing in screen recordings or screen shares. They use transparent or semi-transparent windows, OS-level compositor tricks, and separate display layers to remain invisible to standard monitoring.

The most well-known examples are Parakeet AI and Cluely, but the technique is used by dozens of tools including:

  • Interview assistance overlays
  • Real-time translation tools repurposed for cheating
  • Custom-built transparent browsers
  • Hardware-based HDMI overlay devices

How Transparent Windows Work

Modern operating systems use a compositor to assemble the final display image from multiple window layers. Each window can have properties like:

  • Opacity (0-100%)
  • Blend mode (normal, multiply, screen)
  • Z-order (which window appears on top)
  • Click-through behavior (whether mouse events pass through to layers below)

Overlay tools exploit these properties:

  1. They create a window with partial transparency (e.g., 85% opacity)
  2. They set the "always on top" flag so the window floats above the IDE or browser
  3. They configure click-through so the candidate can interact with the underlying application
  4. They position the window at the screen edge where it is least likely to be noticed by a webcam

Why Standard Detection Fails

Screen Sharing

Video call screen sharing typically captures the primary display output after compositing. However, most applications use the Desktop Duplication API (Windows) or ScreenCaptureKit (macOS), which respect the application's capture exclusion flags. Overlay tools can mark their windows as excluded from screen capture, making them invisible.

Screen Recording

Browser-based or application-based screen recording has the same limitation. It captures what the OS provides, and the OS omits windows that request exclusion.

Webcam Monitoring

The candidate never looks away from their screen. The overlay is in their field of view continuously. A webcam sees a candidate looking normally at their monitor.

Can Screen Overlay Tools Be Detected

Yes — through OS-level window enumeration, process monitoring, and advanced screen capture techniques.

OS-Level Window Enumeration

On Windows, the Desktop Window Manager (DWM) maintains a complete list of all windows, including those excluded from screen capture. The EnumWindows API and DwmGetWindowAttribute function can enumerate every window and its properties:

  • Window position and dimensions
  • Opacity level
  • Excluded-from-capture status
  • Owner process name

A window that is simultaneously:

  • Always on top
  • Partially transparent
  • Excluded from screen capture
  • Owned by a non-system process

...is a strong indicator of an overlay tool.

Process Correlation

Overlay tools must run as applications. Detecting the process that owns a suspicious window is definitive. Common process signatures include:

  • Electron or Chromium-based applications with minimal UI
  • Processes with names containing "overlay," "assist," "helper," or obfuscated strings
  • Applications with screen capture permissions but no legitimate system function

Alternative Capture Methods

Some advanced detection systems use:

  • GPU frame buffer analysis — inspecting the actual rendered frame before display output
  • Kernel-level screen capture — bypassing the standard compositor APIs entirely
  • Hook-based detection — intercepting the API calls that create transparent overlay windows

These methods are more invasive but can detect overlays that user-level monitoring misses.

The Arms Race

Overlay tool developers know about window enumeration. Some countermeasures include:

  • Spawning windows under legitimate process names
  • Using system-level window classes that blend in
  • Hooking the same APIs that monitoring tools use to hide their presence
  • Pure hardware solutions (HDMI splitters with text overlays) that leave no software trace

This is why detection requires multiple layers:

  1. Process scanning catches known tools
  2. Window enumeration catches unknown tools using the same technique
  3. Behavioral analysis catches everything else through behavioral tells
  4. Follow-up questioning validates whether the candidate actually understands their own answers

Bottom Line

Screen overlay tools are the most sophisticated threat to interview integrity today. They are invisible to every monitoring layer most companies use. The only reliable defense is OS-level process and window monitoring combined with structured interviewer validation.

If your monitoring stops at screen sharing, you are not detecting overlay tools — you are giving their users confidence that they will not be caught.