TangleBot can record the screen and stream the data off the device. SpyDealer abuses Accessibility features to steal messages from popular apps such as WeChat, Skype, Viber, and QQ. can take screenshots and abuse the Android Screen Cast feature to capture screen data. Monokle can also abuse accessibility features to read the screen to capture data from a large number of popular applications. Monokle can record the screen as the user unlocks the device and can take screenshots of any application in the foreground. Ginp can capture device screenshots and stream them back to the C2. įlexiSpy can take screenshots of other applications. Įxodus Two can take screenshots of any application in the foreground.

ĮventBot can abuse Android’s accessibility service to capture data from installed applications. ĭrinik can record the screen via the MediaProjection library to harvest user credentials, including biometric PINs. ĭEFENSOR ID can abuse the accessibility service to read any text displayed on the screen. BusyGasper can use its keylogger module to take screenshots of the area of the screen that the user tapped.

Android screen capture