Exploring Android Accessibility Malware
summary
Shows a working Android proof of concept that uses AccessibilityService to automate logins on installed apps by crawling the window node tree, clicking UI elements and filling fields, achieving 5–7 logins per second on one device and enabling a decentralized botnet that pulls scripts and combo lists from a C2. Describes hiding tactics (orientation sensor, wake lock, overlays), notes real-world impact like Xenomorph claiming ~50 million accounts, and flags dangerous permissions such as bind accessibility service and query all apps permission.
AI-written summary · about
chapters (9)
- 0:00Android accessibility malware intro
- 3:20What is credential stuffing
- 5:47Decentralized credential stuffing
- 7:36Automated transfer service malware
- 9:43Implementing malware with accessibility
- 16:29Hiding malware from detection
- 18:58AppdOM mobile security
- 23:41Protecting apps from accessibility malware
- 25:09User precautions against malware
related talks
32mExploring Android Accessibility Malware
20mExploring Android Accessibility Malware
26mAccessibility Service Malwares
34mWhen Accessibility Uses Us Back — Attacks and Defenses Involving Malware and Accessibility
32mHacking the Hackers’ Code: Inside Android Malware
15mBest practices for shielding mobile apps from emerging threats
56mModern Android Hacking
42mThe Ways Hackers Are Taking To Win The Mobile Malware Battle