May 26, 2020 By David Bisson 2 min read

Security researchers uncovered a new Android malware strain called “DEFENSOR ID” that channels its malicious activity through a device’s Accessibility Services.

In its analysis, ESET observed DEFENSOR ID had succeeded in infiltrating the Google Play store, sneaking past mobile security checks by reducing its malicious functionality to a single action: requesting access to a device’s Accessibility Services. This privilege enabled the malware to perform 17 commands received from the attacker, including launching an app and performing a click action remotely instructed by its handlers.

By controlling a device’s Accessibility Services, DEFENSOR ID gave attackers the ability to steal access to and subsequently empty a victim’s cryptocurrency wallet or banking account. This privilege also gave malicious actors the ability to read SMS text messages for the purpose of intercepting a victim’s two-step verification (2SV) code in the event that they had enabled this security feature on their account.

Android Malware Abusing Accessibility Services

DEFENSOR ID isn’t the first Android malware to abuse Accessibility Services in 2020. In March, for instance, McAfee witnessed the Android/LeifAccess.A Trojan exploiting this Android feature to infect a device and post fake reviews on Google Play.

In April 2020, Check Point Research observed the Black Rose Lucy malware family using a fake streaming video optimization (SVO) prompt to trick a victim into granting access to their device’s Accessibility Services. Just a couple of days later, Cybereason detailed the efforts of EventBot to steal user data from financial apps by leveraging Accessibility Services.

Defend Against DEFENSOR ID

Security professionals can help defend their organizations against Android malware such as DEFENSOR ID by creating security policies around the use of mobile devices. Those policies should limit the marketplaces and developers from which employees can download apps onto their corporate devices. Teams should also consider leveraging tools powered by artificial intelligence (AI) to help detect the latest threat behaviors circulating in the wild.

More from

Regulatory harmonization in OT-critical infrastructure faces hurdles

3 min read - In an effort to enhance cyber resilience across critical infrastructure, the Office of the National Cyber Director (ONCD) has recently released a summary of feedback from its 2023 Cybersecurity Regulatory Harmonization Request for Information (RFI). The responses reveal major concerns from critical infrastructure industries related to operational technology (OT), such as energy, transport and manufacturing. Their worries include the current fragmented regulatory landscape and difficulty adapting to new cyber regulations. The frustration appears to be unanimous. Meanwhile, the magnitude of…

Generative AI security requires a solid framework

4 min read - How many companies intentionally refuse to use AI to get their work done faster and more efficiently? Probably none: the advantages of AI are too great to deny.The benefits AI models offer to organizations are undeniable, especially for optimizing critical operations and outputs. However, generative AI also comes with risk. According to the IBM Institute for Business Value, 96% of executives say adopting generative AI makes a security breach likely in their organization within the next three years.CISA Director Jen…

Q&A with Valentina Palmiotti, aka chompie

4 min read - The Pwn2Own computer hacking contest has been around since 2007, and during that time, there has never been a female to score a full win — until now.This milestone was reached at Pwn2Own 2024 in Vancouver, where two women, Valentina Palmiotti and Emma Kirkpatrick, each secured full wins by exploiting kernel vulnerabilities in Microsoft Windows 11. Prior to this year, only Amy Burnett and Alisa Esage had competed in the contest's 17-year history, with Esage achieving a partial win in…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today