Android Accessibility Service is a powerful framework designed for assistive apps such as screen readers, switch controls, and other tools that help users interact with their device. When an app is granted this service, it can observe user interface events, inspect screen content, trigger gestures, click buttons, and respond to changes in the active app.
That power makes it valuable to attackers. Banking trojans and other mobile malware abuse Accessibility Service to automate taps, approve prompts, read sensitive text, bypass security dialogs, and operate inside legitimate apps as if a user were present. It can also support overlay attacks and session takeover by helping malware react to what appears on screen in real time. Defenders should treat unexpected accessibility requests as high risk, restrict permissions to apps with a clear assistive purpose, and monitor for unusual UI automation or overlay behavior.