Clickjacking attacks where users are tricked into enabling Android accessibility features are possible on a majority of devices, enterprise mobile security firm Skycure warned on Tuesday.
The accessibility features offered by the Android operating system can be highly useful for people with impaired vision, hearing or motor skills. However, the Accessibility Service has also been abused by cybercriminals to steal sensitive information and install applications on devices.
Since the accessibility features are disabled by default, attackers need to find a way to convince victims to enable them in order for their malware to work. In many cases, they achieve this by displaying misleading pop-up messages that instruct users to manually enable Accessibility.
In March, researchers at Skycure demonstrated how attackers can enable accessibility features on Android devices by using clickjacking. Basically, attackers create a game that requires the user to click on certain points on the screen. While the user believes they are playing a game, they are actually navigating through Android’s options menu and enabling Accessibility.
Google is well aware of the threat posed by clickjacking attacks so it has added additional protections starting with Android 5.0 Lollipop. Specifically, the company ensured that system permission dialogs – such as the final confirmation “OK” button when activating Accessibility – cannot be covered by an overlay.
However, Skycure researchers discovered that this protection can be bypassed by making a hole in the overlay just on top of the OK button. In order to avoid raising suspicion, the hole does not include the “OK” text and instead it’s placed on top of a white portion of the button.
Skycure has made a video to show how clickjacking attacks can be used to trick users into enabling Accessibility on Android 5.x:
Google has added further protections in the latest version of Android. In Android 6.x Marshmallow, users have to specifically allow an app to create a system overlay, which makes the attack significantly more difficult to pull off. Nevertheless, more than 95 percent of Android devices currently run versions prior to 6.0, which makes them vulnerable to accessibility clickjacking attacks.
Skycure informed Google about the issue in March, but the search giant has determined that the risk posed by this design flaw is low.
Android malware that leverages clickjacking is not unheard of. In late January, Symantec reported that the Android ransomware Lockdroid used clickjacking to gain administrator rights on infected devices.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- AntChain, Intel Create New Privacy-Preserving Computing Platform for AI Training
- Several Major Organizations Confirm Being Impacted by MOVEit Attack
- Verizon 2023 DBIR: Human Error Involved in Many Breaches, Ransomware Cost Surges
- Google Patches Third Chrome Zero-Day of 2023
- Ransomware Group Used MOVEit Exploit to Steal Data From Dozens of Organizations
- Cybersecurity M&A Roundup: 36 Deals Announced in May 2023
- In Other News: Government Use of Spyware, New Industrial Security Tools, Japan Router Hack
- Apple Denies Helping US Government Hack Russian iPhones
Latest News
- AntChain, Intel Create New Privacy-Preserving Computing Platform for AI Training
- Keep Aware Raises $2.4M to Eliminate Browser Blind Spots
- Google Workspace Gets Passkey Authentication
- Cybersecurity Startup Elba Raises €2.5 Million for Employee-Focused Product
- Zoom Expands Privacy Options for European Customers
- Several Major Organizations Confirm Being Impacted by MOVEit Attack
- Apple Unveils Upcoming Privacy and Security Features
- Verizon 2023 DBIR: Human Error Involved in Many Breaches, Ransomware Cost Surges
