Attackers have been deploying BlankBot in the guise of utility apps, which when installed seek accessibility permissions for proper execution before performing an update that enables the acquisition of permissions for total device takeovers.
Article Link: https://www.scmagazine.com/brief/extensive-capabilities-of-new-blankbot-android-trojan-detailed