Like much Android malware today, this malware abuses the Accessibility API.
This API is used to automatically perform UI actions. For example, the malicious sample uses the Accessibility API to record device unlocking gestures. Newer, this SpyNote sample uses the Accessibility API to target famous crypto wallets.
Read more…
Source: Fortinet