Android's accessibility API exists so that software can stand in for a user's eyes and hands. TalkBack, the screen reader that ships with Android, uses it to read every element on screen aloud. Switch Access uses it to let someone operate the entire phone with one or two physical buttons. To do those jobs, an accessibility service is granted capabilities no ordinary app permission approaches: it can read the content of any window, observe every text field as it changes, and inject taps, swipes, and button presses anywhere in the interface.
Read that list again as an attacker. It is a keylogger, a screen scraper, and a remote control, packaged as a single toggle in the settings app.
| Capability | What accessibility needs it for | What malware uses it for |
|---|---|---|
| Read window content | Speaking the screen aloud to a blind user | Harvesting balances, messages, and 2FA codes from any open app |
| Observe text input | Echoing typed characters for confirmation | Capturing passwords and card numbers as they are typed |
| Perform gestures and actions | Operating the phone from a switch or by voice | Approving prompts, granting further permissions, initiating transfers |
| Monitor app changes | Announcing which app has focus | Detecting a banking app launch to trigger an overlay |
How the abuse plays out
A typical infection chain starts outside the accessibility system entirely. FluBot, the trojan that swept Europe between 2020 and 2022, arrived as a text message about a missed parcel delivery with a link to a fake courier app. Anatsa, a family that has surfaced repeatedly in Google Play itself, hides inside apps that genuinely work, such as PDF viewers and QR code scanners, then fetches its payload after installation. Either way, the app's first real move is social: a screen explaining that it needs accessibility access to function, with helpful arrows pointing at the toggle.
Once the service is enabled, the phone is no longer solely the owner's. The trojan watches for a target banking app to open and lays a pixel-perfect fake login screen over the real one; credentials typed into the overlay go to the operator. It reads one-time codes out of incoming notifications and SMS. It can grant itself additional permissions by tapping the consent dialogs faster than the user can see them, and defend itself by pressing Back whenever the user opens its settings page or tries to uninstall it. The most developed families run fraud directly on the device, opening the real banking app and driving it through a transfer while the screen shows the victim something else. From the bank's side, the transaction comes from the genuine device, the genuine app, and the genuine session, which is exactly what fraud detection models trust.
Stalkerware uses the same API for the same reason: it sees everything on screen, including the contents of end-to-end encrypted messengers, which are decrypted for display. Encryption in transit does not help when the endpoint reads the screen. Our stalkerware detection guide covers the fuller sweep; the accessibility list below is the highest-value place to look.
What Google has done about it
Google's countermeasures have tightened in stages, and each stage shows the constraint the platform is under. Play Store policy now restricts the accessibility API to apps that can demonstrate an accessibility purpose, and requires developers to declare it; that pushed the trojans toward droppers and sideloading rather than eliminating them. Play Protect scans installed apps regardless of where they came from. Android 13 added Restricted Settings, which refuses to enable accessibility access for apps installed from outside an app store unless the user digs through a deliberate override flow, on the theory that a malicious app can talk a victim through one toggle but will lose many of them across a multi-step ritual.
The trojans adapted, as documented in analyses of families active since then: some droppers use Android's session-based installation, the same mechanism app stores use, so their payloads do not register as sideloaded and Restricted Settings never triggers. Others simply invest more in the walkthrough. The FluBot takedown in mid-2022 took an international law enforcement operation coordinated by Europol, and the pattern it interrupted reappeared in other families within months.
Why this cannot be fully fixed
The uncomfortable part is that the vulnerability is the feature. An API powerful enough to operate the entire phone on behalf of a user who cannot see it is, by construction, powerful enough to operate it on behalf of someone else. Narrow the API and you break TalkBack for the people who depend on it; gate it behind friction and you tax disabled users hardest; verify "legitimate accessibility purpose" and you have built a review problem, not a security boundary. Apple avoids this class of attack largely by not exposing an equivalent third-party capability, which is also why iOS has historically had a thinner ecosystem of assistive apps. There is no setting of the dial that costs nothing.
So the practical defense is knowing that this one screen in settings is where the phone's real power gets delegated, and keeping that screen short.
Two minutes of auditing
Open Settings > Accessibility and look at the section listing downloaded or installed services. On most phones this list should be empty, or contain only things you recognize and chose: a screen reader, a password manager's autofill helper, a call screening app you use daily. Anything you cannot account for, especially anything installed around the time the phone started behaving oddly, is worth removing today. While you are in the neighborhood, review notification access under Settings > Notifications, which grants a smaller version of the same power (every notification, including 2FA codes, readable by the granted app).
Prevention is mostly about installation paths. Do not install APKs from links that arrive in messages, whatever the pretext; a courier does not need an app to deliver your parcel, and your bank will never send you a "security update" by SMS. Treat any app that asks for accessibility access without an obvious accessibility reason as hostile, no matter which store it came from. And if a support caller asks you to install a screen sharing or remote assistance tool, hang up; that script is the manual version of everything above, aimed at account takeover, and it works on people who would never fall for a fake parcel text.