Somewhere on your phone right now, there's a feature category engineered specifically to help you — and it's one of the most exploitable attack surfaces in mobile security. Accessibility services, remote support apps, and device management profiles were built for legitimate use. Hackers have spent years quietly turning them into master keys.
According to CISA Advisory AA23-025A, threat actors have systematically weaponized legitimate remote monitoring and management (RMM) tools to bypass antivirus software, steal credentials, and maintain persistent access to devices — without triggering a single security alert. The pattern repeats across Android and iOS. And most victims never see it coming.
The Hidden Danger Lurking in Your Device's Support Features
Android's Accessibility Service is the primary offender. Originally built to help users with disabilities control their phones via voice commands or switch access, it sits at an OS level that grants near-total visibility into everything displayed on screen. A malicious app granted accessibility permissions can read your banking app's content, simulate taps and swipes, intercept two-factor authentication codes, and forward all of it silently to a remote server.
The Anubis and Cerberus banking trojans — both confirmed active in the wild — exploited this exact mechanism to drain victims' accounts while appearing to be harmless utility or flashlight apps. They didn't break into the OS. They were invited in through a permissions dialog most people tap through without reading.
iOS isn't immune. MDM (Mobile Device Management) profiles — the same technology enterprises use to manage employee phones — can be silently installed by a malicious actor to control app installation, reroute VPN traffic, and establish rogue certificate trust. A phone enrolled in an attacker-controlled MDM profile can have its entire internet traffic routed through a hostile server. The FTC has documented tech support scams where victims were explicitly instructed to install these profiles, believing they were receiving legitimate technical help.
Then there are remote access apps: AnyDesk, TeamViewer Quick Support, Zoho Assist, and similar tools. Installed under the guise of legitimate support, they hand complete screen control to whoever holds the session ID. Once the call ends, the app often stays installed — and so does the access.
From Data Theft to Device Takeover: What Hackers Could Steal
An attacker with accessibility-level access or an active remote session has an extraordinarily wide attack surface. The damage isn't contained to one account or one data type.
| Helper Tool Abused | Attack Method | What Gets Stolen or Compromised | Real-World Example |
|---|---|---|---|
| Android Accessibility Service | Overlay attacks, keylogging, UI scraping | Banking credentials, 2FA codes, SMS messages | Anubis & Cerberus banking trojans |
| iOS MDM Profile | Rogue certificate install, VPN traffic rerouting | Encrypted traffic, email content, app data | Enterprise certificate abuse in support scam campaigns |
| Remote Access Apps (AnyDesk, TeamViewer) | Persistent screen control, file system browsing | Passwords, financial accounts, private documents | IRS and bank impersonation tech support scams |
| Device Admin Privileges | Remote lock/wipe commands, location tracking | Full device control, real-time location data | Commercial stalkerware applications |
The most dangerous scenario is chained access: malware grants itself accessibility permissions, uses those to scrape your banking password via UI overlays, simultaneously suppresses the SMS notification carrying the one-time code, and completes an unauthorized transfer — while you're watching something else entirely. According to Krebs on Security, this class of automated credential harvesting has become a preferred vector precisely because it requires minimal technical skill from the attacker after initial deployment. The hard work is already baked into the malware.
Simple Checks to See if Your Devices Are at Risk
You can audit most of these attack surfaces in under five minutes — no technical background required for the manual checks, and under two minutes if you have ADB available.
On Android, navigate to: Settings → Accessibility → Installed Services (path varies slightly by manufacturer; on Samsung it's under Advanced Settings). Any app listed there that isn't a keyboard, screen reader, or something you personally configured should be treated as suspect. Revoke access immediately, then investigate the package.
For a faster, more complete check using ADB on a connected PC:
# List all currently active accessibility services by package name
adb shell settings get secure enabled_accessibility_services
# List apps holding Device Admin privileges
adb shell dpm list-owners
# Show all disabled packages (malware sometimes hides this way)
adb shell pm list packages -d
# Check for recently installed apps with high-risk permissions
adb shell pm list packages -i | grep -v "installer=com.android.vending"Any package name you don't recognize in the accessibility output warrants immediate action. Search the exact package name — not just the display name — since malicious apps routinely impersonate legitimate ones.
On iOS, go to: Settings → General → VPN & Device Management. If you see any configuration profile you didn't install yourself for a verified employer or school, remove it immediately. Tap the profile → tap Remove Management. Also check Settings → Privacy & Security → Screen Time for unfamiliar restrictions, which can signal MDM-level control.
For remote access apps: search your installed apps for AnyDesk, TeamViewer, Quick Support, Zoho Assist, or Remote Desktop. If you installed any of these during an unsolicited "support call," uninstall now and assume the session was hostile.
Your Best Defense: Smart Steps to Keep Hackers Out
The core principle is non-negotiable: treat Accessibility Service permissions like root access, because on Android, they functionally are. Everything else follows from that framing.
- Never grant Accessibility Service permissions to sideloaded APKs. Apps installed outside Google Play are the dominant delivery mechanism for accessibility-abusing malware. If a non-Play app requests it, deny and uninstall.
- Run a permissions audit every three months. Set a calendar reminder. Legitimate apps don't silently accumulate new permissions between updates.
- Enable Google Play Protect and leave it active. It specifically flags apps abusing accessibility APIs — not perfectly, but it catches a significant portion of known threats.
- On iOS, never install a configuration profile from a website, email link, or phone call. No legitimate service will cold-contact you and ask for this. Full stop.
- If a remote access app was installed during an unsolicited call, treat your device as compromised. Change every password accessed during that session from a separate, clean device — not the same phone.
- Use a password manager with autofill. Passwords that exist only inside a password manager's encrypted vault can't be scraped via screen overlays the way manually typed credentials can.
The Honest Trade-Off
None of these defenses are frictionless. Disabling accessibility services entirely breaks legitimate tools — text-to-speech engines, switch-access controllers, and a wide range of productivity and assistive apps all rely on the same API that malware exploits. Google has repeatedly attempted to restrict third-party Accessibility Service access and has faced substantial pushback from developers of genuinely useful software.
The architectural problem is unresolved: a permission framework designed for assistive technology is structurally identical to a permission framework for surveillance software. Android's new Restricted Settings feature (introduced in Android 13) requires an extra confirmation step for accessibility grants from sideloaded apps — a partial fix, not a structural one. Until the API itself is redesigned at a fundamental level, the most reliable defense remains a short list of personally vetted apps and a habit of checking what you've given permission to — not a technical solution that eliminates the risk category entirely.
Sources:
- CISA Advisory AA23-025A
- FTC — Tech Support Scams
- Krebs on Security