Locates nodes in the Settings or package-installer user interface by text or view identifier and dispatches synthetic clicks. This lets the application approve its own permission dialogs, complete side-loading, and intercept attempts to reach the uninstall screen without any real user consent.

DEX references AccessibilityService event hooks together with window-overlay creation and credential-capture primitives. This combination is the canonical Android banking-trojan pattern: the app reads screen content and injects fake login windows over legitimate banking apps.

Binds a notification listener service and reads posted notification content, optionally dismissing notifications afterwards to hide them. This harvests one-time passcodes and private messages without ever requesting SMS permissions, which is why it has largely replaced SMS interception in modern ban

Contains step-by-step instructional text walking the victim through enabling an accessibility service. Because Android deliberately makes this flow difficult, malware ships explicit coaching copy; the presence of such a script alongside an accessibility service is a strong abuse indicator.

Acquires a MediaProjection session and pipes the virtual display into an image reader or encoder, enabling continuous capture of everything shown on screen including credentials and one-time codes. Combined with accessibility auto-approval this runs without further user interaction.