Makes use of the framework's Accessibility service

Retrieves information displayed on the phone screen using AccessibilityService.

Reads the content of photos stored on the user's device.

Requests disabling of battery optimizations (often used to enable hiding in the background).

Tries to add a device administrator.

Changes the wallpaper (common with ransomware activity)