Accessibility abuse is the misuse of Android accessibility features to watch or control what is happening on screen. Accessibility services were designed to help users with disabilities by reading interface elements, announcing text, and automating taps or gestures. Malware can request this powerful permission and then use it to inspect app contents, click buttons, scroll pages, or approve prompts without the victim fully understanding what is happening.
In cyber security, this matters because accessibility abuse can let Android trojans bypass many of the usual barriers to fraud. Attackers may use it to capture one-time passwords, disable security settings, grant additional permissions, or operate banking and messaging apps on the victim’s behalf. Defenders look for apps that demand accessibility access without a clear need, especially if they also request overlay, notification, or screen-capture capabilities. On infected devices, unusual accessibility service activity is a strong sign of hands-on manipulation rather than ordinary app use.