Glossary
Accessibility Service (Android)
An Android accessibility service reads on-screen content and performs actions for the user; stalkerware and banking trojans abuse it to spy and self-grant.
An accessibility service is an Android component, declared by an app and enabled by the user in Settings > Accessibility, that receives events describing the content of windows on screen and can act on the user's behalf: reading text, detecting which app is open, performing taps, swipes and global actions such as Back or Home. It exists for screen readers such as TalkBack, switch access and other assistive tools.
The same power makes it the favourite permission of Android malware. With accessibility enabled, stalkerware can read chats as they are displayed and log keystrokes, and banking trojans can overlay login screens, approve their own permission dialogs and block uninstallation. Android 13 introduced restricted settings, which block accessibility for sideloaded apps until the user explicitly allows it from the app's info screen, raising the bar but not removing the risk.
Enabled services are listed in the enabled_accessibility_services key of settings_secure.xml and in adb shell dumpsys accessibility. The accessibility and device admin page explains how to find and date a malicious grant.