Accessibility Service Malwares
summary
Shows a working accessibility-service malware that uses accessibility node tree traversal, overlays, orientation sensors and wake locks to read screens, perform gestures and steal sessions; a demo converts a $1 transfer into $600 without user awareness. Credential-stuffing uses combo lists (Telegram) and a C2 that pushes scripts so infected apps call the app’s real APIs, bypassing MTLS/WAF; tests hit 5–7 logins/sec per device and the ecosystem scales to hundreds of thousands / half a million devices. Android 12/13 mitigations and Abdom-style detection are discussed.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 1:03Credential stuffing explained
- 6:24Overlay malware attacks
- 12:31Legal obligations for accessibility services
- 17:28Automating attacks with C2
- 21:04Masking malware impact
- 22:52Android security improvements
related talks
20mExploring Android Accessibility Malware
32mExploring Android Accessibility Malware
28mExploring Android Accessibility Malware
34mWhen Accessibility Uses Us Back — Attacks and Defenses Involving Malware and Accessibility
32mHacking the Hackers’ Code: Inside Android Malware
15mBest practices for shielding mobile apps from emerging threats
24mRecent Mobile App Security Incidents from Real-World Cases
56mModern Android Hacking