Android/LeifAccess.A is the Silent Fake Reviewer Trojan

Android/LeifAccess.A is a mobile trojan that leverages Android accessibility services to automate app installs, create OAuth-based fake accounts, post fraudulent Google Play reviews, conduct ad-fraud, disable Play Protect, and self-update; it is distributed via social engineering, malvertising, Discord and direct APK links and employs multiple obfuscation techniques and C2-driven commands (report includes IOCs and command tables).