Remote Access Tools
How to Detect Remote Access Tools?
Remote Access Tools (RATs) are software that gives one person full input control over someone else's device — the same category as AnyDesk, TeamViewer, or RustDesk. Built for legitimate IT support, the exact same Android capabilities are what a support-scam or account-takeover operation needs: a screen it can see and hands it can drive, without the victim ever handing over a password. OWASP's MASWE-0055 requirement (Mobile Security Standard) calls this out directly: penetration testers routinely use these same tools to demonstrate data leakage, which is exactly why blocking them is a testable security requirement.
Unlike malware written to attack a specific app, these are often real, signed, widely-used tools. The attacker doesn't need to build anything — they need the victim to install one and grant it two or three permissions.
Where Remote Access Tools Fit Among UI Screen-Capture Threats
RATs are one category in a wider family of "someone else can see or drive this screen" threats:
Remote Desktop Control Apps
TeamViewer, AnyDesk
Social engineering, global data leakage
ADB Video Stream / Control
Vysor, scrcpy
Local data leakage
Screenshot & built-in recording
Default system apps
Global data leakage
Third-party screenshot/recording
AZ Screen Recorder, Loom
Global data leakage
Chromecast / Miracast sharing
Screen mirroring
Local data leakage
RATs are the highest-severity row here — the only category where the attacker isn't just watching, they're operating the device.
How Remote Access Is Abused
Attackers typically rely on three things happening together, none of which is suspicious in isolation:
Accessibility takeover: The victim is walked into enabling Accessibility Service for the "support" app, which then dispatches gestures and reads screen content.
Overlay concealment: A floating control or "connected" indicator is drawn on top of the real UI using SYSTEM_ALERT_WINDOW.
Live screen access: The device's screen is captured, mirrored, or driven through Android's MediaProjection APIs, ADB (scrcpy/Vysor-style tools), or a dedicated virtual display.
Some tools also split these across two packages — a visible main app plus a companion "control plugin" installed separately to hold the Accessibility Service — so a check that only inspects the main package can miss the component that actually has control.
Known vs. Zero-Day RATs
Most RATs abused this way are legitimate, signed applications rather than malware written from scratch, which makes them a good test of what a malware database can and can't do alone.
If the RAT is already known — a leaked build, a cracked APK, a fingerprinted clone — the App Reputation API, backed by Gen's (Norton/Avira) live malware database, catches it as reliably as any other known malware: no permission heuristics needed, near-zero false positives.
If it's a zero-day RAT — a fresh clone, a rebrand, or a legitimate tool no database has flagged yet — there is no single check that catches this reliably, from us or anyone else. The approach has to be defense in depth: several signals that are each common on their own, but rare in combination.
The Solution: Talsec's Defensive Mapping
General Accessibility Services Misuse ( ⭐️The best Anti-RAT feature⭐️)
1) blockScreenControl() available since Q3 2026) + 2) Accessibility Services Misuse Detection Suite (RASP+)
✅ Android 14 / API 34 and above only: blocks both reading and remote control of the marked view
✅ Android 14 / API 34 and above only: bocks both reading and remote control of the marked view
Screen viewed via TeamViewer/AnyDesk-style tools, screenshots, recording, or casting
✅ Yes — blanks the screen for the viewer
Not applicable
A capture attempt already happened
onScreenshotDetected / onScreenRecordingDetected (freeRASP & RASP+)
✅ Detects and alerts in real time
Not applicable
Floating control UI or "connected" overlay
Overlay Detection (RASP+)
Not applicable
✅ Flags the overlay; doesn't block it
Known RAT package name/hash or risky permission combination
Malware Detection — package/permission scanning (freeRASP tier: freeMalwareDetection)
✅ Detects RAT presence
✅ Detects RAT presence
RAT already known to the online malware database
Malware Detection — App Reputation API (Gen / Norton / Avira live DB)
✅ Detects RAT presence with high confidence
✅ Detects RAT presence with high confidence
freeRASP + freeMalwareDetection cover the foundational layer — active screen blocking plus package/permission-based RAT hints, no config required. RASP+ adds built-in reactions, Overlay Detection, Accessibility Services Misuse Detection, and full incident logging for teams that need a configurable, auditable defense. See Malware Detection and RASP+ for how these combine.
Learn more
How to Block Screenshots, Screen Recording, and Remote Access Tools in Android and iOS AppsLast updated
Was this helpful?