Beyond the Happy Path: Lessons Learned from Defending Against Android Malware at Scale

Imagine your perfectly hardened app is breached by a malicious "flashlight" app on the user's device. Android malware can exploit legitimate OS features to spoof user input or capture sensitive data. While most talks stop at accessibility services, this session explores the full threat landscape and the messy reality of defending against it at scale - dealing with differences across API levels, and minimizing UX impact. We will break down the mechanics of prominent attacks: abusing accessibility services to maliciously interact with other apps, task hijacking to intercept intents, UI injections for fake login overlays, custom keyboard keylogging, and the novel Pixnapping attack. Then, we share concrete mitigations you can implement in your application, such as: verifying accessibility service origins, applying obscure touch detection or window punching, building a secure in-app keyboard, utilizing screen recording callbacks.