New Android Malware Channels Malicious Activity Through Accessibility Services

Security researchers uncovered a new Android malware strain called “DEFENSOR ID” that channels its malicious activity through a device’s Accessibility Services.

In its analysis, ESET observed DEFENSOR ID had succeeded in infiltrating the Google Play store, sneaking past mobile security checks by reducing its malicious functionality to a single action: requesting access to a device’s Accessibility Services. This privilege enabled the malware to perform 17 commands received from the attacker, including launching an app and performing a click action remotely instructed by its handlers.

By controlling a device’s Accessibility Services, DEFENSOR ID gave attackers the ability to steal access to and subsequently empty a victim’s cryptocurrency wallet or banking account. This privilege also gave malicious actors the ability to read SMS text messages for the purpose of intercepting a victim’s two-step verification (2SV) code in the event that they had enabled this security feature on their account.

Android Malware Abusing Accessibility Services

DEFENSOR ID isn’t the first Android malware to abuse Accessibility Services in 2020. In March, for instance, McAfee witnessed the Android/LeifAccess.A Trojan exploiting this Android feature to infect a device and post fake reviews on Google Play.

In April 2020, Check Point Research observed the Black Rose Lucy malware family using a fake streaming video optimization (SVO) prompt to trick a victim into granting access to their device’s Accessibility Services. Just a couple of days later, Cybereason detailed the efforts of EventBot to steal user data from financial apps by leveraging Accessibility Services.

Defend Against DEFENSOR ID

Security professionals can help defend their organizations against Android malware such as DEFENSOR ID by creating security policies around the use of mobile devices. Those policies should limit the marketplaces and developers from which employees can download apps onto their corporate devices. Teams should also consider leveraging tools powered by artificial intelligence (AI) to help detect the latest threat behaviors circulating in the wild.

David Bisson

Contributing Editor

Researchers develop malicious AI ‘worm’ targeting generative AI systems

2 min read - Researchers have created a new, never-seen-before kind of malware they call the "Morris II" worm, which uses popular AI services to spread itself, infect new systems and steal data. The name references the original Morris computer worm that wreaked havoc on the internet in 1988.The worm demonstrates the potential dangers of AI security threats and creates a new urgency around securing AI models.New worm utilizes adversarial self-replicating promptThe researchers from Cornell Tech, the Israel Institute of Technology and Intuit, used what’s…

Passwords, passkeys and familiarity bias

5 min read - As passkey (passwordless authentication) adoption proceeds, misconceptions abound. There appears to be a widespread impression that passkeys may be more convenient and less secure than passwords. The reality is that they are both more secure and more convenient — possibly a first in cybersecurity.Most of us could be forgiven for not realizing passwordless authentication is more secure than passwords. Thinking back to the first couple of use cases I was exposed to — a phone operating system (OS) and a…

DOD establishes Office of the Assistant Secretary of Defense for Cyber Policy

2 min read - The federal government recently took a new step toward prioritizing cybersecurity and demonstrating its commitment to reducing risk. On March 20, 2024, the Pentagon formally established the new Office of the Assistant Secretary of Defense for Cyber Policy to supervise cyber policy for the Department of Defense. The next day, President Joe Biden announced Michael Sulmeyer as his nominee for the role.“In standing up this office, the Department is giving cyber the focus and attention that Congress intended,” said Acting…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

Android Malware Abusing Accessibility Services

Defend Against DEFENSOR ID

More from

Researchers develop malicious AI ‘worm’ targeting generative AI systems

Passwords, passkeys and familiarity bias

DOD establishes Office of the Assistant Secretary of Defense for Cyber Policy

Topic updates