Topic
Attacker use of legitimate Android accessibility grants to bypass consent prompts, escalate privilege and persist without exploiting vulnerabilities.
Zimperium says the Android banking Trojan now abuses Accessibility to switch on wireless debugging and run commands through the ADB daemon. The target list is the smaller half of the story.
Perspective Coverage
6 publishersReality
Zimperium says RatHat uses an accessibility grant to switch on Wireless Debugging and read its own 6-digit pairing code, leaving native daemons at shell privilege that keep answering after the app is removed.
Perspective Coverage
6 publishersReality
The malware asks for accessibility, then has a second component build a work profile and copy the bank app into it. Group-IB says the clone registers with the bank as a new device while a black screen hides the transfer.
Reality
Malwarebytes traces fake Indeed "interview" APKs that impersonate the login page, open a VPN, and drop spyware once Accessibility Services is granted. Indeed says its interviews never need an app.
Reality
Zimperium zLabs says the trojan needs two taps from the user, then drives Android settings itself to pair with the local ADB daemon. No root, no CVE, and PC endpoint tooling sees none of it.
Reality