Written By Shubham Arora
Edited By: Shubham Arora | Published By: Shubham Arora | Published: Apr 02, 2026, 08:00 AM (IST)
Android malware using Accessibility permissions can silently control smartphones.
A new type of Android malware is being flagged by the National Cybercrime Threat Analytics Unit, and it’s being referred to as “God Mode.” The name comes from the kind of access it gives attackers once it gets into a device. This is not a typical spam or phishing scam. The concern here is that once this malware is installed, it can quietly take control of your phone in the background. Most users may not even realise something is wrong until it’s too late. Also Read: YouTube comes to Android Auto, but not in the way you expect
It usually starts with a link or file sent through messages, often pretending to be something important like a bank update or service notification. Once you install it, the app asks for Accessibility permissions. This is where things change. These permissions are meant to help with usability, but in this case, they are used to control the phone. Also Read: Google may bring AirDrop-like Tap To Share feature with Android 17
After that, the malware can see what’s on your screen, read messages, and even perform actions on your behalf. That includes entering OTPs, opening apps, or approving requests without you noticing. Also Read: WhatsApp adds multiple accounts on iPhone, easier chat transfer and AI tools
Most cases begin with an APK file sent through WhatsApp or other messages. It may look like a normal app or update, which is why people end up installing it.
Once it is on the phone, it keeps running quietly. It doesn’t always show up like a regular app, which makes it harder to spot.
This is where things get serious. The malware can access OTPs, personal messages, and contact details. It can also place calls, forward them, or show fake screens on banking apps. In simple terms, it can use your phone the way you would, but without you knowing. That puts both your money and personal data at risk.
One reason this threat stands out is because it stays hidden. The app may not appear on the home screen, and it can avoid basic checks. Since everything happens in the background, many users don’t realise anything is wrong until there is already some damage.
You can also dial ##002# to turn off any unknown call forwarding.
Start by removing anything you don’t recognise and checking app permissions. If the problem doesn’t go away, resetting the phone may be the safest option. You can also report the issue through the cybercrime helpline 1930 or the official portal.