The attackers are creating fake overlays to trick users into providing login credentials for financial services apps, including potentially for crypto exchanges.