Inception Attacks: Immersive Hijacking in Virtual Reality Systems

1 Introduction

• By exploiting VR’s immersive realism and lack of reliable app-authentication cues, attackers can manipulate what users see and hear, including sensitive data and social interactions.The paper notes that VR systems avoid service indicators and security icons typical of desktop and mobile environments.Source: §1 · pp. 1–2
• In an inception attack, users interact through an attacker-controlled app that simulates the expected VR environment, while their interactions are monitored, recorded, and modified in real time.Figure 1 depicts the user’s perceived direct app interaction versus the simulated environment inside the attacker’s inception layer.Source: §1 · p. 1, Figure 1 · p. 1
• All but one of 27 participants were deceived, including experienced users; half could not identify anything unusual even after the attack was disclosed.Participants who recalled glitches attributed them to standard VR performance issues; nearly all were cosmetic and could be reduced by tuning the app and content.Source: §1 · p. 2
• The authors identify immersive hijacking as a new attack class that can manipulate social interactions beyond eavesdropping on sensitive data.They also propose a multifaceted defense pipeline intended to raise attack cost and reduce the likelihood of success.Source: §1 · p. 2
• The Meta Quest implementation uses VR’s operating process to trap users in a replicated 3D home with simulated apps, rather than injecting overlays or covertly foregrounding an app.The authors report hijacking interactions with 2D and 3D apps, including financial transactions and live VRChat conversations.Source: §1 · p. 2

2.1 Existing Attacks against VR

• VR attack research includes malware, sensor-based privacy attacks, app and input eavesdropping, and perceptual manipulation that can alter movement or orientation.Prior perceptual attacks may require a malicious app or privileged access to headset feeds or configuration files.Source: §2.1 · pp. 2–3

2.2 GUI Confusion Attacks

• Browser and mobile GUI attacks use overlays or foreground-UI replacement to deceive users, with defenses including frame busters, app vetting, and protected UI elements.Browser clickjacking can overlay a transparent frame; mobile attacks can obscure interface components or elevate a background process.Source: §2.2 · p. 3
• Traditional GUI attacks do not directly transfer to VR, whose single 3D environment supports no overlays and makes disruptive foreground switching noticeable.VR also lacks endpoint and information-flow authentication mechanisms common on other platforms, while visible security indicators can conflict with immersion.Source: §2.2 · p. 3

3 Inception Attacks

• An inception attack traps users in a malicious app masquerading as the full VR system, where inputs and outputs can be intercepted, relayed, and altered.The attacker operates as a hidden layer of indirection between users and external entities.Source: §3 · p. 3

3.1 Threat Model

• The threat model assumes a clean headset with developer mode enabled and an adversary without physical or root access, but with resources to build apps and scripts.The authors describe this as their most likely threat model while noting that other attack-enabling models are discussed.Source: §3.1 · p. 4

3.2 Overview of the Attack Process

• The attacker builds a target-customized inception app containing a replicated 3D home environment and simulated versions of installed apps.The paper describes app construction as a one-time cost that can then be customized for users and their configurations.Source: §3.2 · p. 4
• At app exit, a background script intercepts the signal, stops subsequent activities, and starts the inception app instead of returning the user to the benign home.The transition is timed to an expected disruption in immersion, which the authors say can help avoid suspicion.Source: §3.2 · p. 4
• Once in the replicated home, users’ interactions pass through the app, and intercepted exits return them there, keeping users trapped while interactions can be modified.The replicated home includes a 3D background and an app menu.Source: §3.2 · p. 4, Figure 2 · p. 4

4.1 Preliminaries: Meta Quest VR

• ADB access can be obtained through a wireless request on the same WiFi network or through an installed app embedding ADB; the authors proceed with the first approach.The alternative app-based approach can target users who install a disguised utility app.Source: §4.1 · p. 5

4.2 Constructing the Inception App

• The attacker uses headset configuration to compile a customized app with a replicated 3D home and simulated versions of the target’s installed apps.The attack implementation is described for Quest 2, Quest 3, and Quest Pro.Source: §4 · p. 4, §4.2 · p. 5

4.2.1 Collecting Headset Configurations

• The attacker identifies the current home’s background APK, lists installed packages, and collects app state such as recently used apps.The paper describes using ADB logs to identify the background APK and dumpsys to access state information.Source: §4.2.1 · p. 5

4.2.2 Replicating the 3D Home Environment

• The replicated home combines the background, app menu, interaction handling, app launch and exit management, and device settings.The background APK and app images are used for the scene and menu; the paper also describes using Meta’s Interaction SDK for user input.Source: §4.2.2 · p. 5

4.2.3 Simulating the Installed Apps

• Four app-simulation approaches provide varying hijacking capability, from launching the real app to GUI replication or full session interception.For credential theft, a replicated login page captures credentials before loading the original app; local API simulation can also alter inputs and displayed data.Source: §4.2.3 · p. 6

4.3 Activating the Inception

• A background script monitors headset activity and, on detecting an app exit, stops subsequent activities and activates the inception app.The packaged app is around 700MB, primarily because of its 3D home scene.Source: §4.3 · p. 6

5.1 Hijacking Meta Quest Browser

• The authors replicate Quest Browser’s interface in Unity, display web content through Android WebView, and use Meta’s Interaction SDK to track user actions.They report that the replica closely mirrors the real browser; Figure 4 provides a side-by-side comparison.Source: §5.1 · p. 7, Figure 4 · p. 7
• The Quest Browser replica supports three real-time attacks: eavesdropping on sensitive data, changing displayed website content, and modifying user input.It can record credentials and other entries, and alter content returned from the server before rendering it; Figure 5 shows a balance changed to $10.Source: §5.1 · p. 7, Figure 5 · p. 7
• The attack modifies a Zelle transfer from $1 to $5 while showing $1 on the confirmation page, concealing the altered amount from the user.The bank’s final confirmation shows the actual $5 transaction; the authors leave that page unmodified to demonstrate the attack.Source: Figure 6 · p. 7, §5.1 · p. 8

5.2 Hijacking VRChat

• The VRChat attack can give Alice and Madison different versions of a conversation, including a changed answer and fabricated speech sent to the other user.Figure 8 illustrates Alice hearing “No” when Madison answered “Yes,” and Madison receiving crafted speech from Alice.Source: Figure 8 · p. 8
• In the VRChat setup, a laptop/headset combination relays audio between Alice and Madison, allowing the attacker to monitor and modify their live conversation.Audio streams in both directions with 0.4–0.6 seconds of delay over the tested 5GHz WiFi setup; the replica uses attacker-predefined avatar motions rather than livestreamed visual frames.Source: §5.2 · pp. 8–9

5.3 Discussion: Implications of the Attack

• The authors describe the demonstrated attacks as limited instances of a broader capability to track behavior and manipulate users’ sensory input, output, and immersive experiences.They note that generative AI could strengthen these capabilities, while describing the potential attack vectors as virtually limitless.Source: §5.3 · p. 9

6.1 Study Setup

• The deception study withheld attack details until debriefing, received institutional IRB approval, and discarded participants’ personal data after the study.The researchers also discarded interview recordings after analyzing responses.Source: §6 · p. 9, §6.1 · p. 10
• The study recruited 27 participants with varied VR experience and staged the attack during a two-part session on Meta Quest Pro headsets.During Part I, researchers secretly installed and ran the inception app; in Part II, the attack transitioned participants to a replicated home and browser.Source: §6.1 · p. 9

6.2 Results

• Nearly all discrepancies participants reported were cosmetic, and the authors say fine-tuning the app and improving context replication could reduce or eliminate them.Examples included a different cursor size and missing recent-app status.Source: §6.2 · p. 10
• Participants commonly explained their lack of suspicion by treating unusual operations as familiar VR glitches or harmless discrepancies.Experienced users described being accustomed to system fluctuations, while some less experienced users noticed differences but did not consider them suspicious.Source: §6.2 · p. 10
• Trust in reputable apps and repetitive behavior helped explain why participants entered personal information into the malicious replica.Participants completed the Google form twice, first in a legitimate browser and then in the replica, and some said they repeated the same actions without hesitation.Source: §6.2 · p. 10
• 26 of 27 participants were successfully deceived, including highly experienced VR users; all but one proceeded without observable suspicion or hesitation.After debriefing, 14 participants recalled discrepancies, but all except the suspicious expert attributed them to ordinary system variations or glitches.Source: §6.2 · p. 10

7 Additional User Study: Hijacking VRChat

• Participants in the new study played the VR counterpart interacting with an inception target, addressing how counterparts react to altered interactions.The study’s RQ3 asks how VR counterparts respond to a target’s interactions altered by the attack.Source: §7 · p. 11

7.1 Study Setup

• The study used 12 participants in three groups differing in VR experience and familiarity with the interviewer’s voice.Each group had four participants; the groups included experienced users, less-experienced users, and less-experienced users familiar with the interviewer.Source: §7.1 · p. 11

7.2 Results

• In Part II, the attacker replaced live interviewer audio with a recording; two participants noticed better audio quality but did not find it suspicious.The authors suggest adding real-world background noise to recordings to better match live conditions.Source: §7.1 · p. 11, §7.2 · p. 11
• 10 of 12 participants expressed no suspicion; both who did were familiar with the interviewer and questioned Part II.One noticed a one-sided conversation after a clarification went unanswered; the other found a prerecorded response generic and indifferent.Source: §7.2 · p. 11
• None of the participants in Groups 1 or 2 voiced suspicions or artifacts; of 12 participants, 10 expressed no suspicion, and both who did were from Group 3 and concerned Part II.Source: §7.2 · p. 11
• The study’s takeaway is that prerecorded target audio can deceive VR counterparts, while reliably deceiving people familiar with the target requires more attacker effort.The authors anticipate that advances in generative AI could provide more realistic speech audio.Source: §7.2 · p. 11

• With developer mode off, non-system apps installed from the official store cannot run shell scripts.The alternative model assumes an attacker without headset access can publish a seemingly benign app containing hidden inception components.Source: §8 · p. 12
• A custom exit button can transition users into the app’s simulated home environment, triggering the inception attack.The button does not actually exit the app; it activates the hidden attack components.Source: §8 · p. 12
• Mimicking headset customizations is challenging because discrepancies in the home environment or installed apps could raise suspicion.On Meta Quest, the app can collect installed-package information, but when multiple background files exist the attacker cannot determine which is active, risking a mismatch.Source: §8 · p. 12
• The app cannot intercept controller home-button presses, so users can leave the attack, limiting how often they are trapped.The paper identifies keeping users trapped as an open challenge in this threat model.Source: §8 · p. 12

9 Potential Defenses

• The proposed multifaceted defense pipeline pairs defensive elements with attack counterparts to raise attack costs and reduce the likelihood of success.The paper groups potential defenses into prevention, detection, and hardware-based mitigation.Source: §9 · p. 12, Table 1 · p. 13

9.1 Attack Prevention

• Disabling developer mode may impede installation, but relying on tutorials and migrating use cases leaves protection dependent on user choices.Even with developer mode disabled, an attacker could publish a seemingly benign app, so app stores should test apps and updates for abnormal exit behavior or simulated home environments.Source: §9.1 · p. 12
• Preventing non-system apps from launching other apps raises attack cost but can increase VR development costs and reduce app usability.Authenticating app calls and transitions is a practical alternative that raises attacker overhead, though it is not foolproof.Source: §9.1 · p. 13

9.2 Attack Detection

• Reliable attack detection is highly challenging because VR behavior and performance vary, while immersion can reduce users’ awareness of subtle indicators.Proposed detection approaches include static analysis, runtime monitoring, and manual user detection.Source: §9.2 · p. 13
• Frequent short-lived legitimate home environments can indicate an inception attack, but attackers can disrupt this pattern by intermittently not intercepting the home signal.A virtual exit button can shift the attack toward user-controlled transitions, at higher attack cost.Source: §9.2 · p. 13

9.3 Hardware-based Mitigation

• Regular headset restarts can stop the running attack process and reduce its active time, but interrupt users who want to resume their prior VR session.A restart does not remove the inception app or shell script.Source: §9.3 · p. 13

• The Meta Quest implementation could eavesdrop on and modify what users see, hear, and send to VR apps, including financial transactions and live conversations.The authors report that user studies validated the potency of these attacks in real-world settings.Source: §10 · p. 13
• The authors anticipate that more powerful VR hardware could enable seamless, real-time injection of generative-AI versions of users’ avatars or voices.They call for VR platforms and developers to improve security and educate users about potential risks.Source: §10 · pp. 13–14

11.1 Additional Materials for §4.3

• The activation script monitors headset events and launches the inception app when the user exits an app.The appendix includes a shell-script snippet that detects a controller event and starts the inception app.Source: §11.1 · p. 17

11.2 Additional Materials for §5.1

• Browser-side JavaScript changes displayed page content, including setting a transaction amount to $5 and changing the confirmation-page amount shown to the user.The appendix also includes a code snippet for altering the displayed account balance.Source: §11.2 · p. 17

11.3 Additional Materials for §5.2

• Figure 9 contrasts Alice’s view in Carl’s VRChat replica with Madison’s view in the legitimate app, where Carl impersonates Alice.The appendix identifies the screenshots as views seen in the two users’ headsets during a hijacked VRChat session.Source: Figure 9 · p. 17, §11.3 · p. 17

11.4 Full-sized Views of Figure 4 and Figure 6

• The appendix includes two figure views: Figure 10 provides a full-sized view of Figure 4, while Figure 11 is an enlarged view of Figure 6.Source: §11.4 · p. 17

11.5 Additional Materials for §6

• The appendix includes demographic tables for participants in the §6 and §7 user studies.Table 3 separately reports the measured VR home loading times.Source: §11.5 · p. 17, Table 2 · p. 17, Table 3 · p. 17
• The inception attack adds an average of only 1.5 seconds to VR home loading time across the measured apps.Table 3 reports mean and standard deviation across 10 trials per app; the added delay is spent loading app assets and scenes.Source: §11.5 · p. 17, Table 3 · p. 17

Observed Discrepancies

• Four participants recalled that the home-button exit popup was missing, and three noticed that recent-app status was not displayed.The simulated home in the study did not show recent-app status because the researchers did not consider it necessary at the time.Source: Observed Discrepancies · p. 17
• Participants also reported shorter controller cursor beams and reduced responsiveness in some interface components.P14 specifically noted a shorter cursor beam than in the legitimate interface.Source: Observed Discrepancies · p. 18
• P5, P9, and P12 noticed slightly longer VR home loading during inception, while measurements showed an average increase of 1.5 seconds.The extra time occurs during attack activation; after assets and scenes are loaded, perceived home loading is nearly identical to the no-attack scenario.Source: Observed Discrepancies · p. 18
• The authors say the first four discrepancy types could be addressed by making replicas more precise, including by accessing recent-app history through an ADB command.They separately attribute the loading delay to the difference between loading the VR home and initializing an app.Source: Observed Discrepancies · p. 18

Interview Questions in §6

• The interview prompts ask whether participants observed suspicious or unusual occurrences and why, whether they hesitated to disclose personal information, how they felt about Part I and Part II, and what differed.Source: Interview Questions in §6 · p. 18, Interview Questions in §7 · p. 18

11.7 Additional Defense Strategies

• Secure authentication on networking ports may limit unauthorized remote installation, but it does not stop insider attacks or an app requesting its own ADB access.A safe bootloader and secure enclave could block installation or execution, but the authors cite limited enclave capacity, complexity, and high implementation cost as practical barriers.Source: §11.7 · pp. 18–19
• Kiosk mode can restrict enterprise users’ app access, but limits flexibility, raises operating costs, and may be unavailable for personal headsets.A compromised system managing kiosk mode would also place the entire system under attacker control.Source: §11.7 · p. 19
• Disabling OS-shell access would impede attack scripts but also prevent legitimate users from running or managing processes and would not stop app-based inception attacks.Enforcing single-app operation for 3D apps has limited effect because a shell script can reactivate the inception app after the current app exits.Source: §11.7 · p. 19
• Control-flow monitoring may flag frequent, diverse app calls, but complex user-driven flows and more common app calling between legitimate apps can produce false alarms.Performance profiling is also noisy and may be harder when an attacker adapts the inception app to mimic benign apps.Source: §11.7 · p. 19
• User education and frequent home customization may help users notice or frustrate precise replication, but self-detection is likely unreliable in VR.The authors cite users’ familiarity with imperfect systems and immersive experiences that can overwhelm awareness of subtle indicators.Source: §11.7 · p. 19
• A hard reset removes the inception app and shell script, but significantly disrupts headset use; secure bootloader and enclave defenses face cost barriers.An attacker would need to inject the app again after a hard reset.Source: §11.7 · pp. 18–19
• The appendix includes enlarged browser and Zelle figures, illustrating subtle replica differences and a transaction whose displayed amount differs from the amount confirmed by the bank.The Zelle example shows the target entering $1, seeing $1 on the confirmation page, and the bank confirming $5.Source: Figure 10 · p. 20, Figure 11 · p. 20