Threat Actors Exploit Malware Loaders to Circumvent Android 13+ Accessibility Safeguards

Threat actors have successfully adapted to Google’s stringent accessibility restrictions introduced in Android 13 and later versions.

These safeguards, rolled out in May 2022, were designed to prevent malicious applications from abusing accessibility services by blocking such access for sideloaded apps.

However, cybercriminals have found ways to bypass these protections, leveraging sophisticated malware loaders and session-based package installers to deploy malicious payloads with alarming efficiency.

This trend, observed throughout 2024, signals a persistent arms race between security developers and attackers, with significant implications for mobile device security and user data protection.

Innovative Bypasses

One of the standout tools in this ongoing threat landscape is TiramisuDropper, a session-based installer that has become a favored mechanism among operators of Android banking trojans like Hook, TgToxic, and TrickMo.

According to Intel471 Report, this loader enables attackers to sidestep Google’s restrictions, ensuring that malware can exploit accessibility features to harvest sensitive data and execute unauthorized actions.

Additionally, in April 2024, an actor known as Samedit_Marais, or BaronSamedit, publicly shared the source code for the Brokewell Android loader on the Exploit cybercrime forum.

This loader, specifically engineered to evade Android 13+ accessibility defenses, has lowered the barrier for other developers to integrate similar capabilities into their malware.

The public availability of such tools not only amplifies the risk of widespread adoption but also hints at a potential decline in specialized “dropper-as-a-service” models like TiramisuDropper, as noted by ThreatFabric researchers, who predict market restructuring due to this saturation of accessible bypass techniques.

Rise of TiramisuDropper and Brokewell Loaders

The implications of these loaders are profound, as they facilitate a surge in malware equipped with hidden virtual network computing (HVNC), keylogging, and remote control functionalities.

Unlike traditional web-injects, which demand frequent updates and resources, these stealthier methods reduce operational overhead while enabling real-time monitoring and manipulation of infected devices.

Attackers often use HVNC to recreate a device’s screen on their servers, overlaying deceptive interfaces to mask illicit actions like unauthorized taps or text inputs.

Moreover, the shift from labor-intensive automated transfer systems (ATSs) to manual on-device fraud through remote screen control highlights a strategic pivot by threat actors, prioritizing simplicity and high success rates over complex automation.

This trend, combined with the exploitation of loaders like Brokewell, underscores the evolving sophistication of Android malware campaigns.

Compounding the issue is the proliferation of leaked source code for advanced malware such as Hook and ERMAC, which has fueled a rise in nontechnical cybercriminals entering the fray.

Since July 2023, when Intel 471 identified leaked Hook source code on GitHub, at least nine malware variants have emerged, with over a dozen customized control panels surfacing in underground markets by mid-2024.

This accessibility has democratized cybercrime, albeit with limited traction among seasoned actors due to the prevalence of recycled or nonfunctional offerings.

As the Android malware landscape continues to evolve, the circumvention of accessibility restrictions remains a critical challenge, necessitating robust threat monitoring and continuous intelligence sharing to stay ahead of these adaptive adversaries.

The growing integration of such loaders into malware underscores an urgent need for enhanced security measures to protect users from these increasingly stealthy and pervasive threats.