Accessibility-service abuse is the misuse of Android’s accessibility framework to gain extra control over what a user sees and does on a device. Accessibility services are meant to help users with disabilities by reading screen content, describing interfaces, and automating interaction. In malware, that same power can be turned into surveillance and control: attackers can observe app screens, click buttons, approve permissions, dismiss warnings, scroll forms, and capture text entered into financial or login screens.
This matters because it can bypass many user-facing defenses without exploiting the operating system itself. Banking trojans and spyware often abuse accessibility to enable credential theft, authorize fraudulent actions, or support overlay attacks and fake updates. Defenders should treat unexpected accessibility requests as high risk, restrict sideloading, monitor for suspicious accessibility services, and use mobile security controls that flag excessive UI automation or permission abuse. On sensitive apps, limiting exposed screen content and hardening transaction flows can reduce the impact of this technique.