> For the complete documentation index, see [llms.txt](https://docs.talsec.app/appsec-articles/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.talsec.app/appsec-articles/glossary/remote-access-tools.md). # Remote Access Tools Remote Access Tools (RATs) are software that gives one person full input control over someone else's device — the same category as AnyDesk, TeamViewer, or RustDesk. Built for legitimate IT support, the exact same Android capabilities are what a support-scam or account-takeover operation needs: a screen it can see and hands it can drive, without the victim ever handing over a password. OWASP's [MASWE-0055](https://mas.owasp.org/MASWE/MASVS-PLATFORM/MASWE-0055/) requirement (Mobile Security Standard) calls this out directly: penetration testers routinely use these same tools to demonstrate data leakage, which is exactly why blocking them is a testable security requirement. Unlike malware written to attack a specific app, these are often real, signed, widely-used tools. The attacker doesn't need to build anything — they need the victim to install one and grant it two or three permissions.
### Where Remote Access Tools Fit Among UI Screen-Capture Threats RATs are one category in a wider family of *"someone else can see or drive this screen"* threats: | Category | Common Examples | Threat | | -------------------------------- | ------------------------ | --------------------------------------- | | **Remote Desktop Control Apps** | **TeamViewer, AnyDesk** | Social engineering, global data leakage | | ADB Video Stream / Control | Vysor, scrcpy | Local data leakage | | Screenshot & built-in recording | Default system apps | Global data leakage | | Third-party screenshot/recording | AZ Screen Recorder, Loom | Global data leakage | | Chromecast / Miracast sharing | Screen mirroring | Local data leakage | RATs are the highest-severity row here — the only category where the attacker isn't just watching, they're operating the device. ### How Remote Access Is Abused Attackers typically rely on three things happening together, none of which is suspicious in isolation: **Accessibility takeover:** The victim is walked into enabling Accessibility Service for the "support" app, which then dispatches gestures and reads screen content. **Overlay concealment:** A floating control or "connected" indicator is drawn on top of the real UI using `SYSTEM_ALERT_WINDOW`. **Live screen access:** The device's screen is captured, mirrored, or driven through Android's `MediaProjection` APIs, ADB (scrcpy/Vysor-style tools), or a dedicated virtual display. Some tools also split these across two packages — a visible main app plus a companion "control plugin" installed separately to hold the Accessibility Service — so a check that only inspects the main package can miss the component that actually has control. ### Known vs. Zero-Day RATs Most RATs abused this way are legitimate, signed applications rather than malware written from scratch, which makes them a good test of what a malware database can and can't do alone. **If the RAT is already known** — a leaked build, a cracked APK, a fingerprinted clone — [the App Reputation API](broken://spaces/YZhrVzZ29IQQW7fgoDrV/pages/Ma2OEv7pvbHhFIdShlFS), backed by Gen's (Norton/Avira) live malware database, catches it as reliably as any other known malware: no permission heuristics needed, near-zero false positives. **If it's a zero-day RAT** — a fresh clone, a rebrand, or a legitimate tool no database has flagged yet — there is no single check that catches this reliably, from us or anyone else. The approach has to be defense in depth: several signals that are each common on their own, but rare in combination. ### The Solution: Talsec's Defensive Mapping | Threat Vector | Talsec Relevant Feature | Stops seeing | Stops controlling | | ------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | | **General Accessibility Services Misuse ( ⭐️The best Anti-RAT feature⭐️)** | **1) `blockScreenControl()`** *available since Q3 2026)* + **2)** **Accessibility Services Misuse Detection** Suite *(RASP+)* | ✅ *Android 14 / API 34 and above only:* blocks both reading and remote control of the marked view | ✅ *Android 14 / API 34 and above only:* bocks both reading and remote control of the marked view | | Screen viewed via TeamViewer/AnyDesk-style tools, screenshots, recording, or casting | `blockScreenCapture()` *(*[*freeRASP*](https://docs.talsec.app/freerasp/freerasp/introduction) *&* [*RASP+*](https://docs.talsec.app/premium-products/product/rasp)*)* | ✅ Yes — blanks the screen for the viewer | Not applicable | | A capture attempt already happened | `onScreenshotDetected` / `onScreenRecordingDetected` *(freeRASP & RASP+)* | ✅ Detects and alerts in real time | Not applicable | | Floating control UI or "connected" overlay | Overlay Detection *(RASP+)* | Not applicable | ✅ Flags the overlay; doesn't block it | | Known RAT package name/hash or risky permission combination | [Malware Detection](https://docs.talsec.app/premium-products/product/malware-detection) — package/permission scanning *(freeRASP tier:* [*freeMalwareDetection*](https://docs.talsec.app/freerasp/freemalwaredetection/introduction)*)* | ✅ Detects RAT presence | ✅ Detects RAT presence | | RAT already known to the online malware database | Malware Detection — App Reputation API *(Gen / Norton / Avira live DB)* | ✅ Detects RAT presence with high confidence | ✅ Detects RAT presence with high confidence | *freeRASP + freeMalwareDetection cover the foundational layer — active screen blocking plus package/permission-based RAT hints, no config required. RASP+ adds built-in reactions, Overlay Detection, Accessibility Services Misuse Detection, and full incident logging for teams that need a configurable, auditable defense. See Malware Detection and RASP+ for how these combine.* ### Learn more {% content-ref url="/pages/5U638HgKtVvLjSo0nUch" %} [How to Block Screenshots, Screen Recording, and Remote Access Tools in Android and iOS Apps](/appsec-articles/articles/how-to-block-screenshots-screen-recording-and-remote-access-tools-in-android-and-ios-apps.md) {% endcontent-ref %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.talsec.app/appsec-articles/glossary/remote-access-tools.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.