Malicious Android apps force adware on users by hijacking the Android Accessibility Service and can be extremely difficult to uninstall
Android adware can install itself even when users explicitly reject it — Hard-to-uninstall apps can also hijack Android Accessibility Service.
Context & Ripple Effects
This report extends a pattern researchers had already documented weeks earlier, when 20K adware samples on third-party app stores were found using root access to make themselves nearly impossible to remove. What's new here is the mechanism: instead of exploiting root vulnerabilities, these apps abuse the Android Accessibility Service — a legitimate system API meant for users with disabilities — to install themselves even after an explicit rejection and resist uninstallation.
That matters because it moves the threat inside the bounds of normal app behavior. The later record bears this out: the SimBad adware embedded in over 200 games and the CooTek adware across 238 Play Store apps with 440M+ installs both spread through officially distributed apps rather than sideloaded binaries.
First-order effects
- Affected users face adware that installs itself despite explicit rejection and survives standard uninstall attempts, since the Accessibility Service grants the persistence the app needs.
- Google inherits a review problem: apps abusing the Accessibility Service look like ordinary software at submission time, so the Play Store's existing vetting does not catch them.
Second-order effects
- The abuse of a legitimate accessibility API pressures Google to restrict what non-accessibility apps can do with the service — a tightening that also constrains legitimate developers who had leaned on it for automation features.
- Third-party stores, already shown distributing root-exploiting adware, come under added scrutiny as distribution vectors distinct from the Play Store's own admission process.
Third-order effects
- If adware keeps migrating from exploit-based rootkits toward abuse of sanctioned system permissions, removal difficulty becomes a function of permission design rather than malware sophistication — pushing platforms toward stricter institutional admission control over sensitive APIs.
- Researchers' later finding that a meaningful share of infected users end up with compromised system partitions suggests the industry trajectory is toward infections users cannot self-remediate, shifting remediation responsibility onto carriers, OEMs, and the platform itself.
The trend: Android adware is evolving from sideloaded root exploits toward abuse of legitimate system APIs like the Accessibility Service, forcing platform holders to treat permission governance as their primary defense line.