Do Son Evolved ClayRat spyware uses Accessibility Services to install a keylogger and lockscreen bypass. It leverages self-defense (blocking uninstallation) and screen recording for comprehensive surveillance.
MediaProjection API
AntiDot, an Android trojan from LARVA-398, is infecting thousands of devices via MaaS, using MediaProjection API and Accessibility Services to steal financial and personal data.