Accessibility Services and Device Admin Abuse

What it is

Most Android spyware does not exploit anything. It asks the user, or whoever holds the phone for a few minutes, to switch on three powerful features:

• An accessibility service, designed for screen readers and switch access, receives the content of every window and can perform taps and gestures. Stalkerware uses it to read chats on screen and log keystrokes; banking trojans use it to overlay login screens and approve their own permission prompts.
• A notification listener receives the full content of every notification: message previews, one-time codes, emails.
• Device admin (and, in managed deployments, device owner or profile owner) lets an app lock the screen, enforce password rules, wipe the device, and, crucially for malware, resist uninstallation until the admin is deactivated.

These grants are stored in plain system files. Finding an unexpected package in any of them is one of the fastest and most reliable stalkerware indicators on Android.

Where it lives

All files are in settings storage or /data/system, written in ABX on most Android 12+ builds.

What it proves

• The exact component granted accessibility or notification access, and whether accessibility is globally enabled.
• The apps registered as device administrators, the policies each requested (force lock, wipe data, reset password, disable camera, watch login) and whether it is a device or profile owner.
• On Android 13 and later, whether a sideloaded app needed the Allow restricted settings override to obtain accessibility or notification access, which requires deliberate steps in the app's info screen.

It proves capability, not use: an enabled service could read the screen, and other artifacts (network logs, app data, appops access times) show whether and when it did.

Key fields

Timestamps

None of these entries records when it was granted. Build the time from:

• The modification time of settings_secure.xml and device_policies.xml, and the setting's id sequence number.
• usagestats events for com.android.settings accessibility or device admin screens right before.
• The app's install time in installed packages, usually minutes earlier.

adb shell settings get secure enabled_accessibility_services
adb shell settings get secure enabled_notification_listeners
adb shell dumpsys device_policy | grep -iE 'admin|owner'
adb shell dumpsys accessibility | grep -iE 'Bound services|Enabled services'

Retention

These entries reflect current state. Malware often hides its launcher icon, but it cannot hide these grants from the files. Disabling a service or deactivating an admin removes the entry immediately; uninstalling the app removes everything. Traces of an earlier grant can remain in notification history, logs in a bugreport, and usagestats.

Collection

• Logical first: the commands above take seconds and need no root. androidqf collects them with package lists and APKs.
• Bugreport: includes accessibility, device policy and notification dumps.
• Full file system extraction: the XML files with their timestamps.

Parsing

• MVT (mvt-android check-androidqf or check-bugreport) reports accessibility services, device admins and suspicious permissions, and matches packages against indicator lists.
• jadx and Apktool decompile the suspect APK to confirm what the service does and to find its command server.
• ALEAPP reports some of these settings.

Investigator tips

• Legitimate accessibility users exist: password managers, launchers, automation apps, screen readers. Judge each by its signer (see APK signing), install source and behaviour, not by name.
• A package with accessibility or device admin, no launcher icon, an installer that is a browser or file manager, and a generic name ("System Service", "Update") is the classic stalkerware profile.
• Deactivate a malicious device admin only after collection and on instruction: removing it changes the evidence and can trigger a wipe policy.
• Follow the full procedure in the malware and stalkerware triage guide.