Evolved Malware Takes Advantage of Accessibility Features

There have been some pretty relentless instances of banking malware over the years. One of the more dangerous ones has now been modified and “improved” to take advantage of the functions on Android devices that assist those with disabilities. The accessibility features allow voice commands and voice feedback, use of braille accessories, and other tools to assist users with navigation and use of smartphones and tablets. Kaspersky Lab has found that Svpeng has been changed to take advantage of those very things.

The malware now can embed itself into the accessibility feature. It can then steal data in any textbox by logging every keystroke made on the device.

A warning to users that the malware may be trying to install is that an app will ask for access to the accessibility features. While there are apps that likely will need access to these, if you are not installing such an app and are asked for this permission, shut down the app immediately and uninstall it.

A lot of malware tries to get users to give it access to administrator features too. It’s a pretty safe bet that whatever app you are trying to install doesn’t really need those. If it requests them, you may want to reconsider that particular product. There are very few that do need those and unless you are a developer of the app, you probably don’t need to enable that.

Good news is that so far, Kaspersky has not seen this version widely used.  But, even in its “older” form, it’s very dangerous. It can steal data using SMS and overlay legitimate banking applications with fake ones in order to steal login credentials.