Clickjacking attacks where users are tricked into enabling Android accessibility features are possible on a majority of devices, enterprise mobile security firm Skycure warned on Tuesday.
The accessibility features offered by the Android operating system can be highly useful for people with impaired vision, hearing or motor skills. However, the Accessibility Service has also been abused by cybercriminals to steal sensitive information and install applications on devices.
Since the accessibility features are disabled by default, attackers need to find a way to convince victims to enable them in order for their malware to work. In many cases, they achieve this by displaying misleading pop-up messages that instruct users to manually enable Accessibility.
In March, researchers at Skycure demonstrated how attackers can enable accessibility features on Android devices by using clickjacking. Basically, attackers create a game that requires the user to click on certain points on the screen. While the user believes they are playing a game, they are actually navigating through Android’s options menu and enabling Accessibility.
Google is well aware of the threat posed by clickjacking attacks so it has added additional protections starting with Android 5.0 Lollipop. Specifically, the company ensured that system permission dialogs – such as the final confirmation “OK” button when activating Accessibility – cannot be covered by an overlay.
However, Skycure researchers discovered that this protection can be bypassed by making a hole in the overlay just on top of the OK button. In order to avoid raising suspicion, the hole does not include the “OK” text and instead it’s placed on top of a white portion of the button.
Skycure has made a video to show how clickjacking attacks can be used to trick users into enabling Accessibility on Android 5.x:
Google has added further protections in the latest version of Android. In Android 6.x Marshmallow, users have to specifically allow an app to create a system overlay, which makes the attack significantly more difficult to pull off. Nevertheless, more than 95 percent of Android devices currently run versions prior to 6.0, which makes them vulnerable to accessibility clickjacking attacks.
Skycure informed Google about the issue in March, but the search giant has determined that the risk posed by this design flaw is low.
Android malware that leverages clickjacking is not unheard of. In late January, Symantec reported that the Android ransomware Lockdroid used clickjacking to gain administrator rights on infected devices.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Apple Denies Helping US Government Hack Russian iPhones
- Zero-Day in MOVEit File Transfer Software Exploited to Steal Data From Organizations
- Russia Blames US Intelligence for iOS Zero-Click Attacks
- Cisco Acquiring Armorblox for Predictive and Generative AI Technology
- Moxa Patches MXsecurity Vulnerabilities That Could Be Exploited in OT Attacks
- Organizations Warned of Salesforce ‘Ghost Sites’ Exposing Sensitive Information
- Organizations Warned of Backdoor Feature in Hundreds of Gigabyte Motherboards
- Barracuda Zero-Day Exploited to Deliver Malware for Months Before Discovery
Latest News
- OpenAI Unveils Million-Dollar Cybersecurity Grant Program
- Galvanick Banks $10 Million for Industrial XDR Technology
- Information of 2.5M People Stolen in Ransomware Attack at Massachusetts Health Insurer
- US, South Korea Detail North Korea’s Social Engineering Techniques
- High-Severity Vulnerabilities Patched in Splunk Enterprise
- Idaho Hospitals Working to Resume Full Operations After Cyberattack
- Enzo Biochem Ransomware Attack Exposes Information of 2.5M Individuals
- Apple Denies Helping US Government Hack Russian iPhones
