Accessibility Service Archives

AppWizard

March 29, 2026

This app made me hate today’s giant Android smartphones a little less

Smartphones are becoming larger and more visually appealing, but this trend can hinder one-handed usability. Quick Cursor is an app available on the Google Play Store that introduces a floating cursor to enhance one-handed operation. Users can activate the cursor by swiping inward from the lower half of the screen, allowing for easier interaction with UI elements located higher up. The app overlays a cursor that can be controlled with tap and swipe actions, and it requires access to Android's accessibility service for setup. Quick Cursor operates on a freemium model, offering basic functionality for free, with additional features available through a subscription or one-time purchase. It provides a more fluid experience compared to Android's built-in one-handed mode, making it easier to navigate larger smartphones like the Samsung Galaxy S26 Ultra and Google Pixel 10 Pro XL.

AppWizard

March 19, 2026

New Perseus Android Banking Malware Monitors Notes Apps to Extract Sensitive Data

Cybersecurity researchers have identified a new family of Android malware called Perseus, designed for device takeovers and financial fraud. It utilizes Accessibility-based remote sessions for real-time monitoring and interaction with infected devices, particularly targeting Turkey and Italy. Perseus monitors user notes to extract personal or financial information and is distributed through dropper applications via phishing websites. It expands on the codebase of previous malware like Phoenix and employs disguises as IPTV services to reduce user suspicion. Once operational, it performs overlay attacks and captures keystrokes to steal credentials from financial applications. The malware allows operators to issue commands through a command-and-control panel, enabling various malicious actions, including capturing note content and initiating remote visual streams. Perseus also conducts environment checks to evade detection and ensure it operates on legitimate devices.

AppWizard

February 21, 2026

Android users put on high alert: Malware hides in TV streaming apps

A new strain of malware called Massiv has been identified by the fraud detection firm ThreatFabric. This malware disguises itself as legitimate IPTV applications to steal financial information and identities. IPTV refers to Internet Protocol Television, often associated with unauthorized content streaming. Many of these malicious apps are not found on reputable platforms, leading users to unofficial sources where malware can be embedded. The malware can monitor screens in real-time and extract data from the phone's Accessibility Service, allowing attackers to interact with devices without users' knowledge. Cybercriminals can then open bank accounts in victims' names, leading to debts with banks the victims have never interacted with. ThreatFabric has noted an increase in fake IPTV applications used for malware delivery, particularly in Portugal, Spain, France, and Turkey. Many of these apps do not provide free content but instead deliver malware. Users are advised to avoid sideloading applications from untrusted sources.

AppWizard

February 19, 2026

New ‘Massiv’ Android banking malware poses as an IPTV app

A new strain of Android banking malware called Massiv is disguised as an IPTV application to steal digital identities and access online banking accounts. It uses screen overlays and keylogging techniques to capture sensitive information and can take remote control of compromised devices. Massiv has been observed targeting a Portuguese government application related to Chave Móvel Digital, which contains user data that could bypass know-your-customer (KYC) verifications. The malware allows fraudsters to open accounts in the victim's name at new banks and services, enabling money laundering and loan acquisition. Massiv features two remote control modes: a screen live-streaming mode and a UI-tree mode that extracts structured data from the Accessibility Service. There has been an increase in the use of IPTV applications as bait for Android malware infections, with many of these apps serving as droppers for the malware. The fake IPTV apps primarily target users in Spain, Portugal, France, and Turkey. Users are advised to download applications only from reputable sources and keep security measures active.

AppWizard

February 13, 2026

Android’s Advanced Protection Mode now targets your favorite customization, automation apps

Google is refining its Advanced Protection Mode to enhance security for high-risk individuals by implementing new restrictions on the AccessibilityService API. This API, while beneficial for users with disabilities, has been misused by various applications, leading to security vulnerabilities. Google now requires applications that assist users with disabilities to declare their status as Accessibility Tools by including the isAccessibilityTool attribute in their metadata. Recent updates in the Android Canary 2602 release allow Advanced Protection Mode to disable access to the Accessibility Service API for apps that do not qualify as Accessibility Tools, revoking any previously granted permissions. When enabled, Advanced Protection Mode restricts apps like dynamicSpot, which rely on the Accessibility Service API, while allowing classified Accessibility Tools to function normally. This change aims to improve security by treating non-Accessibility Tools as incompatible with a secure environment.