They are calling the main attack UI state inference attack (looking at shared memory for window manager state changes) from which they begin an Activity hijacking attack (phishing). The camera attack is merely taking a picture right after a secured app (e.g. Banking app) has taken a picture.

The paper is linked in the article. Here are demos linked from their paper: https://sites.google.com/site/uistateinferenceattack/demos