Pixnapping attacks begin with the malicious app invoking Android programming interfaces that cause the authenticator or other targeted apps to send sensitive information to the device screen. The malicious app then runs graphical operations on individual pixels of interest to the attacker. Pixnapping then exploits a side channel that allows the malicious app to map the pixels at those coordinates to letters, numbers, or shapes.

It works like screenshotting the 2FA tool. It’s an Android issue.

Little bit off-topic: Linux PC

BTW this is a reminder why we need a secure Wayland solution on our desktop Linux PC. Because this sort of stealing under X11 is possible too.