At the center of this campaign is smartphone hijacking malware engineered to exploit the Android Accessibility Service. Designed originally to help disabled users interact with screen elements, this native utility permits an application to read on-screen text, simulate touches, and monitor background processes. In the hands of bad actors, it acts as a digital master key.
Once active, the mobile banking trojan initiates credential harvesting across all major installed applications. It maps screen coordinates, logs keystrokes, and detects whenever the victim opens high-value financial utilities. If the user launches a banking app, the trojan can inject an invisible screen overlay to intercept login credentials, master PINs, and biometric verification tokens.
The malware then executes a complete device takeover attack. Because the software possesses screen-interaction privileges, it can dismiss security alerts, grant itself silent SMS interception rights, and steal one-time passcodes (OTPs) before the phone owner notices an incoming notification. The victim continues watching short videos while the background process systematically dismantles their device's defenses.
