Exploring Android Accessibility Malware
summary
Demonstrates a working Android accessibility service malware that automates credential stuffing by parsing combo lists, using a C2 to receive target app names and UI scripts, and driving the accessibility node tree with performAction to fill fields and press login buttons. Tests hit 5–7 login attempts per second per device and scale to ~6,000 attempts/sec with 1,000 infected phones. Hides activity via orientation sensors, wake locks and overlays and succeeds against app UIs without special permissions.
AI-written summary · about
chapters (10)
- 0:00Android accessibility malware intro
- 2:39Credential stuffing attacks
- 5:07ATS malware steals funds
- 6:57Accessibility service basics
- 8:23Malware demo creation
- 13:14Popular apps vulnerability
- 14:41Scaling with distributed devices
- 15:45Hiding from user detection
- 18:42Summary and real-world impact
- 19:04About Appdom
related talks
32mExploring Android Accessibility Malware
28mExploring Android Accessibility Malware
26mAccessibility Service Malwares
32mHacking the Hackers’ Code: Inside Android Malware
34mWhen Accessibility Uses Us Back — Attacks and Defenses Involving Malware and Accessibility
15mBest practices for shielding mobile apps from emerging threats
42mThe Ways Hackers Are Taking To Win The Mobile Malware Battle
56mModern Android Hacking