Android App Security · Spotting Bad Apps · Lesson 2 of 5

Overlays & Banking Trojans

See why a battery app that wants accessibility access is after your bank.

Why a battery app wants your screen

An accessibility service is a special kind of app that helps people use their phone in a different way. A screen reader speaks what's on the screen for someone who is blind. A switch control app lets someone with limited movement tap buttons using a single switch. To do that job, these services need to see what's on the screen and press things for you.

That same power is exactly what a banking trojan wants. A trojan is malware disguised as something useful, and a banking trojan's goal is your bank logins and the codes that protect them. So a common trick is an ordinary looking app, like a battery saver or a PDF reader, that begs you to turn it on in Settings, Accessibility.

Android puts up two roadblocks. First, since Android 13, if an app was sideloaded from a browser, a messaging app or a file download, its accessibility switch is locked behind a restricted setting. You'll see a message saying the setting is unavailable for your security. To get past it you'd have to open the app's App info page, open its menu, and choose Allow restricted settings. Newer versions reportedly extend the lock to more powerful settings. Apps installed from an app store aren't blocked this way, so the roadblock targets sideloads specifically.

Second, any accessibility service shows a warning asking whether to allow the app full control of your device. It spells out that the service can view and control the screen, and view and perform actions. It also says plainly that full control is appropriate for accessibility apps, but not for most apps.

A battery booster has no reason to read your screen. If an app talks you through unlocking a restricted setting, treat that as an alarm.

On the simulated phone, try to turn on Battery Booster Pro, get past both screens, then open the bank app and watch what the service can see.

Overlays and stolen codes

If the real bank screen hides your password, how do trojans get it? The classic answer is an overlay: a fake screen drawn on top of a real app. Android has a permission for this, shown as Display over other apps on many phones. Chat bubbles and floating video players use it legitimately.

Here's how the trick fits together. The trojan uses its accessibility access, or a list of installed apps, to notice when you open your bank. It instantly covers the bank with a copy of the bank's own login page. You type your username and password into the copy, and they go to the attacker. Security researchers documented this behavior in FluBot and in Anatsa, among many other families.

Logins alone often aren't enough, because banks send a one-time code by text. So trojans also try to read your SMS messages or your notifications, and with accessibility they can read a code right off the screen. Some go further and use accessibility to tap buttons themselves, approving a payment while showing you a fake loading screen. Some also block you from opening the settings page you'd use to remove them.

Android keeps tightening this up. Restricted settings now also cover things like notification access and display over other apps for sideloaded apps on newer versions. Google Play Protect scans apps when you install them, including ones from outside Play, and can disable or remove known malware.

Warning signs worth remembering:

• A simple app that asks for accessibility, notification access or display over other apps
• Instructions to unlock a restricted setting
• Your bank's login appearing at an odd moment, or twice
• Settings closing by themselves when you try to look at an app