There's a permission "draw over other apps" which has legitimate uses but is also used for crap like this.