And give it accessibility permission, which comes with a big fat warning. Basically you need to tell Android "yes, install and run this random app I don't really need, and give it access to all my info".

Yeah but that wouldn't solve this issue? The malware stole data from the app on the users device, not from a server.

What do you mean? Similar vulnerabilities/apps/phishing has been available on iOS since at least 2020.

That's why you never just download and install random shit from the Internet. You gotta know and trust your source. I sidelaod all the time. Never had an issue, I just don't grab random shit from random sites.

A user has to click a lot of buttons to make this work, android security is doing its job. If there's any failing on android security's part, it's consolidating permissions into accessibility services instead of breaking them out into something a user might get scared to click.

Then again, they did click accessibility services on a "secure messaging" app. They need to learn somehow. I just refuse to accept that the appropriate solution is not owning things you buy. There has to be a better way.

I always chuckled at my Android friends having to run AV software on their phones, but then we got Pegasus and it got harder to be smug… then the shenanigans from “legitimate” devs like Über and Tencent. It doesn’t seem like blindly trusting Apple was a great idea anymore.

I won’t be sideloading anything onto my device that I can’t build myself from opensource and understand what it’s doing.

The risk is too damn high otherwise.