Remote-access capability is the ability for malware or an operator to control an infected device from a distance. Instead of only stealing data automatically, the attacker can issue commands, view the screen, trigger apps, read messages, capture credentials, or move through a device as if sitting in front of it.
This matters because remote access turns a single compromise into an interactive foothold. In mobile threats, it can support banking fraud, spyware, and follow-on abuse such as changing settings or approving transactions. Defenders look for signs like suspicious accessibility use, overlay abuse, unusual background services, and command-and-control traffic. Some malware tries to reduce its dependence on direct internet access by using local relay paths or nearby compromised devices, which can make the remote operator harder to spot using normal network monitoring alone.