Exploring Android Accessibility Malware
summary
Shows a working Android malware prototype that uses accessibility service hooks to perform credential stuffing from infected user devices: a background accessibility service launches target apps, traverses the accessibility node tree, fills login fields and clicks buttons at ~5–7 attempts/sec, and reports to a C2 for per‑app scripts. Demonstrates overlays, wake locks and orientation tricks to hide activity, cites ~500–600 attacked apps and tens of thousands of victims, and explains mitigation tradeoffs vs accessibility compliance.
AI-written summary · about
chapters (11)
- 0:00Android accessibility malware intro
- 1:29Credential stuffing attacks
- 3:14Decentralized botnet credentials
- 3:56Automated banking transfers
- 8:54Accessibility service attacks
- 10:43Writing credential malware
- 17:24Hiding malware techniques
- 20:39Bypassing security stealth
- 22:03Accessibility vs security balance
- 25:18Defending with Appdome
- 26:23Q&A
related talks
20mExploring Android Accessibility Malware
28mExploring Android Accessibility Malware
26mAccessibility Service Malwares
34mWhen Accessibility Uses Us Back — Attacks and Defenses Involving Malware and Accessibility
32mHacking the Hackers’ Code: Inside Android Malware
15mBest practices for shielding mobile apps from emerging threats
42mThe Ways Hackers Are Taking To Win The Mobile Malware Battle
56mModern Android Hacking