Android banker: accessibility service abuse with overlay injection

DEX references AccessibilityService event hooks together with window-overlay creation and credential-capture primitives. This combination is the canonical Android banking-trojan pattern: the app reads screen content and injects fake login windows over legitimate banking apps.

Android dropper: runtime DEX/class loading of a staged payload

Sample resolves and loads executable code at runtime via DexClassLoader/InMemoryDexClassLoader combined with reflection and asset or network payload retrieval. Legitimate apps rarely need in-memory DEX loading; this is the standard staging mechanism for Android droppers evading store review.

Boot-triggered restart with disguised foreground service

Restarts itself on device boot and holds a foreground service with a low-visibility notification channel, keeping the process alive across reboots and outside normal background limits. Malicious use is distinguished by pairing this with surveillance or remote-control primitives.

Covert microphone or camera capture with exfiltration

Opens audio or camera capture outside any user-facing recording feature and pairs it with file staging and network transmission. The absence of a foreground recording interface alongside these primitives indicates surveillance rather than a legitimate media function.

Notification listener abuse for OTP and message theft

Binds a notification listener service and reads posted notification content, optionally dismissing notifications afterwards to hide them. This harvests one-time passcodes and private messages without ever requesting SMS permissions, which is why it has largely replaced SMS interception in modern ban