Lookout observed Shedun abusing the Android Accessibility Service for its malicious means. Using the accessibility service toolset in the delivery of malware is pretty uncommon, so we took a deeper look. Shedun does not exploit a vulnerability in the service, instead it takes advantage of the services legitimate features. The malware is evolving quickly and we believe well see more sophisticated families surfacing in the future, says Lookout. It likely uses this technique to increase its revenue by guaranteeing the installation and execution of advertised applications.”]