How to Find the Android Apps That Can See Your Screen, and Lock Them Out

The scariest Android malware doesn’t break your phone’s security. It asks for permission, and people say yes.

The latest example is RatHat, a banking trojan that researchers at Zimperium’s zLabs detailed in September and that Fox News flagged again on Oct. 2. It spreads through text-message phishing, malicious ads and shady download sites, usually disguised as a streaming app or even Chrome. Once installed, it leans on Android’s Accessibility Service and Wireless Debugging to watch the screen, grab two-factor codes and even rebuild your PIN or unlock pattern from where you tap. Zimperium says it uses generative AI to find its way around app screens on its own.

Google says no apps carrying RatHat have been found on the Play Store and that Play Protect blocks known versions. That’s reassuring, but the defense that actually stops this whole category of malware is knowing which apps hold the keys. Here’s how to check.

Step 1: Audit your Accessibility apps

Accessibility access lets an app read what’s on screen and tap on your behalf. Legitimate tools like screen readers and password managers sometimes need it. Almost nothing else does.

1. Open Settings and go to Accessibility.
2. Look for a section called Downloaded apps or Installed apps (Samsung uses the second name).
3. Tap each entry. If you don’t recognize it, or can’t explain why it needs to control your phone, turn it off.
4. Then uninstall that app from Settings > Apps.

If an app keeps nagging you to turn Accessibility back on right after you disable it, treat that as a red flag, not a reminder.

Step 2: Check the other powerful permissions

Accessibility isn’t the only door. Starting with Android 15, Google treats several permissions as “restricted settings” for sideloaded apps: notification access, device admin, display over other apps and usage access, plus SMS permissions and the default dialer and messaging roles.

1. Go to Settings > Apps > Special app access.
2. Review Notification access, Display over other apps, Usage access and Device admin apps. On some phones, it’s faster to search Settings for “device admin.”
3. Revoke anything that doesn’t have an obvious reason to be there.

One more rule: if a sideloaded app ever walks you through opening its App info page, tapping the three-dot menu and choosing Allow restricted settings, stop. That warning exists because malware asks for exactly this.

Step 3: Turn off Wireless debugging

Wireless debugging is a developer tool that lets a computer send commands to your phone over Wi-Fi. RatHat switches it on to dig deeper into the system. Most people never need it.

1. Go to Settings > System > Developer options. If you don’t see Developer options at all, you’ve never enabled them, and you can skip this step.
2. Make sure Wireless debugging is off. If you don’t use developer tools, turn off the Developer options toggle at the top, too.

Step 4: Confirm Play Protect is scanning

1. Open the Play Store, tap your profile picture and choose Play Protect.
2. Tap the gear icon and make sure Scan apps with Play Protect is on.
3. Run a manual scan while you’re there.

Step 5: Consider Advanced Protection

If you sideload rarely and want Google to slam the door for you, Advanced Protection is the strongest option on Android 16. Turn it on at Settings > Security & privacy > Advanced Protection, then toggle Device protection. You’ll need a screen lock first, and your phone may ask to restart.

According to Google’s support page, it makes Play Protect mandatory, blocks installs from unknown sources, restricts accessibility tools, enables Theft Detection Lock and reboots a phone that’s been locked for 72 hours. It also blocks 2G connections on supported devices, which can cost you signal in rural dead zones, and Google warns that one memory-safety feature may slow some apps slightly. For most people who bank on their phone, that’s a fair trade.

If you think you’re already infected

Don’t try to outsmart a remote-access trojan by deleting one app. From a different device, change your banking and email passwords and call your bank. Then back up your photos and contacts and do a factory reset on the phone. Afterward, reinstall apps only from Google Play.

None of this takes long. Five minutes in Settings won’t make you invincible, but it shuts the exact doors that RatHat and its copycats need open.

Sources: Fox News, Infosecurity Magazine, 9to5Google, Google Support. Photo by Franck on Unsplash.