{"id":34749,"date":"2020-05-01T09:00:11","date_gmt":"2020-05-01T09:00:11","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\/"},"modified":"2020-05-01T09:00:11","modified_gmt":"2020-05-01T09:00:11","slug":"android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\/","title":{"rendered":"Android trojan EventBot abuses accessibility services to clear out bank accounts \u2013 fortunately, it’s ‘in preview’"},"content":{"rendered":"
<\/div>\n

Researchers have analysed a new strain of Android malware that does not yet exist in the wild.<\/p>\n

Cybereason boffins did this by observing submissions to virus detection site VirusTotal not from the general public, but from one source presumed to be miscreants testing whether the nasty would be spotted.<\/p>\n

Its creators call the malware EventBot, though if it is released it could be disguised within other apps that claim to be games or utilities, or marketed as a component to other criminals. In the Cybereason report<\/a>, the researchers describe how they tracked a succession of submissions, seeing “features” added as the coders improve EventBot’s capabilities.<\/p>\n

EventBot asks the user for permission to use accessibility services, a powerful feature since these services require extensive permissions in order to work, including acting as a keylogger, for example, and running in the background.<\/p>\n

EventBot also requires Android permissions including reading internal storage, reading and sending SMS messages, launching automatically after system boot, showing windows on top of other apps, and requesting to install additional packages. Some of these permissions prompt the user, even stating that the app needs to “observe text you type \u2013 includes personal data such as credit card numbers and passwords.”<\/p>\n

Wouldn’t most users refuse such permissions? Assaf Dahan, who leads the research team, told The Reg<\/em>: “Most users that are not tech-savvy will not question why the app needs this or that permission, they will just give it so they can let the app run. Most people don’t even bother reading it, there’s a lot of trust. The human link is the weakest link in cyber security.”<\/p>\n

Once installed, the app downloads a configuration file with currently around 200 financial targets, including PayPal, Coinbase, Barclays, HSBC, Santander, Starling, Lloyds, Mondo, Revolut, TSB, Tesco and Bank of Scotland \u2013 a full list is in the report. When active, it can perform webinjects, intercepting data sent to target sites. Along with the ability to read SMS messages, it may be able to defeat some types of two-factor authentication. It can grab screen PINs, “most likely to give the malware the option to perform privileged activities on the infected device related to payments, system configuration options,” the report explained.<\/p>\n

The most recent versions of EventBot use obfuscation to disguise class names in the code.<\/p>\n

Cybereason said that one-third of all malware now targets mobile endpoints, and that 60 per cent of devices accessing enterprise data are mobile. In mitigation, though, both Android and iOS are designed with stricter permissions than desktop PCs, and protected by the fact that most applications are installed via a curated store. Would EventBot have any chance of getting past Google’s malware checks?<\/p>\n

“I’d like to say that would never happen but the facts prove us wrong,” said Dahan. “It doesn’t happen often, but malware is found in the Play store. It’s not unheard of.”<\/p>\n

Evidence of this was confirmed recently by Kaspersky researchers, who said<\/a> of a malware campaign dubbed “PhantomLance”: “We found dozens of related samples that had been appearing in the wild since 2016 and had been deployed in various application marketplaces including Google Play. One of the latest samples was published on the official Android market on November 6, 2019. We informed Google of the malware, and it was removed from the market shortly after.”<\/p>\n

According to Kaspersky: “We spotted a certain tactic often used by the threat actors for distributing their malware. The initial versions of applications uploaded to app marketplaces did not contain any malicious payloads or code for dropping a payload. These versions were accepted because they contained nothing suspicious, but follow-up versions were updated with both malicious payloads and code to drop and execute these payloads.”<\/p>\n

Concerning EventBot, you would expect that the authors will read the Cybereason report and make changes to avoid identification. “That’s part of this eternal cat-and-mouse game,” said Dahan. “Malware is polymorphic, it mutates all the time to evade antivirus and other security products.”<\/p>\n

Despite the existence of EventBot and other mobile malware, is it not true that mobile devices are still more secure than desktop PCs, which are more open and allow users more freedom in installing apps from anywhere? “The attack surface is broader with desktop,” Dahan told us, “but the world is shifting fast towards mobile. Banking trojans were really big on desktop, today they have to have a mobile component. Today most banks have two-factor authentication with a code either generated or sent to the mobile phone. Threat actors have to adapt and switch to mobile.”<\/p>\n

The solution is for users to resist giving excessive permissions to apps they install, and for Google to up its game when it comes to detecting malicious submissions \u2013 though we emphasise that EventBot itself has not yet been spotted anywhere other than on VirusTotal. \u00ae<\/p>\n

Sponsored:<\/span> Practical tips for Office 365 tenant-to-tenant migration<\/a><\/p>\n

READ MORE HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Researchers analysing samples submitted to VirusTotal find new strain Researchers have analysed a new strain of Android malware that does not yet exist in the wild.\u2026 READ MORE HERE…<\/p>\n","protected":false},"author":2,"featured_media":34750,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[63],"tags":[],"class_list":["post-34749","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-the-register"],"yoast_head":"\nAndroid trojan EventBot abuses accessibility services to clear out bank accounts \u2013 fortunately, it's 'in preview' 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Android trojan EventBot abuses accessibility services to clear out bank accounts \u2013 fortunately, it's 'in preview' 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2020-05-01T09:00:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/05\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"563\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Android trojan EventBot abuses accessibility services to clear out bank accounts \u2013 fortunately, it’s ‘in preview’\",\"datePublished\":\"2020-05-01T09:00:11+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\\\/\"},\"wordCount\":827,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview.jpg\",\"articleSection\":[\"The Register\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\\\/\",\"name\":\"Android trojan EventBot abuses accessibility services to clear out bank accounts \u2013 fortunately, it's 'in preview' 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview.jpg\",\"datePublished\":\"2020-05-01T09:00:11+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview.jpg\",\"width\":1000,\"height\":563},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Android trojan EventBot abuses accessibility services to clear out bank accounts \u2013 fortunately, it’s ‘in preview’\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Android trojan EventBot abuses accessibility services to clear out bank accounts \u2013 fortunately, it's 'in preview' 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\/","og_locale":"en_US","og_type":"article","og_title":"Android trojan EventBot abuses accessibility services to clear out bank accounts \u2013 fortunately, it's 'in preview' 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2020-05-01T09:00:11+00:00","og_image":[{"width":1000,"height":563,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/05\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview.jpg","type":"image\/jpeg"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Android trojan EventBot abuses accessibility services to clear out bank accounts \u2013 fortunately, it’s ‘in preview’","datePublished":"2020-05-01T09:00:11+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\/"},"wordCount":827,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/05\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview.jpg","articleSection":["The Register"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\/","url":"https:\/\/www.threatshub.org\/blog\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\/","name":"Android trojan EventBot abuses accessibility services to clear out bank accounts \u2013 fortunately, it's 'in preview' 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/05\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview.jpg","datePublished":"2020-05-01T09:00:11+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/05\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/05\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview.jpg","width":1000,"height":563},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/android-trojan-eventbot-abuses-accessibility-services-to-clear-out-bank-accounts-fortunately-its-in-preview\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Android trojan EventBot abuses accessibility services to clear out bank accounts \u2013 fortunately, it’s ‘in preview’"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/34749","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=34749"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/34749\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/34750"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=34749"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=34749"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=34749"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}