AI Weekly Malaysia

Google announced that Android 17, when Advanced Protection is enabled, will restrict AccessibilityService access exclusively to verified apps categorized as Accessibility Tools. The AccessibilityService API runs in the background, intercepts UI events and acts on other apps; Google says banking trojans and spyware have abused it to read sensitive data, draw fake login screens over legitimate apps, log keystrokes and initiate fraudulent transfers without root. The post also lists earlier countermeasures: blocking sideloaded apps from enabling accessibility services, in-call protections against disabling Play Protect or granting accessibility permissions, and the accessibilityDataSensitive flag developers can set on sensitive views or composables.

Why: If your Android app uses AccessibilityService for anything other than assistive technology — automation, screen reading, UI scripting, task bots — it will stop working for any user with Advanced Protection on, so check whether your app can be verified and categorized as an Accessibility Tool before your next release. Separately, the accessibilityDataSensitive flag mentioned here is something you can set today on views/composables that show balances, OTPs or personal data, which is a concrete hardening step you can ship without waiting for Android 17.

A Hacker News thread (255 points, 105 comments) centers on a developer's X post describing their run-in with Google's Android Developer Verification Program: their personal Play Store account was closed for inactivity, they could not create a replacement Play Console account, and when they turned to shipping an APK via F-Droid they say they hit a $25 verification fee plus an identity check. The post also claims that even distributing to fewer than 20 users requires a verified payments profile and an answer to a question about publishing on Android. The article text is a truncated copy of that post, so the program mechanics are reported second-hand from one developer's experience, not from Google's own documentation.

Why: If you ship or plan to ship an Android APK outside the Play Store — including dev builds handed to a handful of friends or testers — do not assume sideloading stays free and anonymous; per this account, the verification gate, the $25 charge, and the payments-profile requirement apply even below 20 users. Two concrete decisions follow: verify the current rules on Google's own developer page before you plan a distribution route, and don't let an existing Play Console account sit inactive if you want to keep it, since this poster's account was closed and could not be restored. For solo and small-team builders here shipping to a global store, an ID-verification plus fee gate is extra friction worth budgeting time for — but treat the specifics as unverified until you read Google's terms directly.

A developer who bought 10 identical Android 6.0.1 phones (2GB RAM) for an SMS-gateway deployment describes being pushed off Google Play: their text editor Tabby was rejected with a screenshot of an unrelated NSFW app attached to the review, and the appeal was rejected without explanation. They note that repeat offenses can lead to full developer account deletion, so they stopped trying to 'debug' the review process and will ship games and tools via F-Droid and itch.io instead. They also reference an unspecified 'latest monopoly consolidating move' by Google without giving details.

Why: If you distribute on Play, this is a concrete argument for maintaining a second channel: the stated downside here is losing the entire developer account, not just one rejected app, which is why the author refused to re-submit and probe the review. There is also a hardware note for anyone building device fleets — Android 6.0.1 with 2GB RAM was sufficient for their SMS-gateway use case. Nothing in this piece is Malaysia- or SEA-specific; it is a general platform-risk account.

Cleafy traced nearly 100 deployments since April 2026 of the RatHat Android banking-trojan console, run as malware-as-a-service where each customer operates a separate copy. The latest console versions — following an earlier one called Fisher and newer builds named BlackCat Remote Control Management and Panda Workshop V5/V6 — feed captured text messages and credentials from fake banking-app overlays to Google's Gemini to estimate each victim's bank balance and sort phones into high-value and mid-value groups; Cleafy found no use of the model to move money, only to decide 'which victims are worth an operator's time.' The console doubles as a build tool: it signs the malicious app, publishes it to Amazon S3 or a web server, and can rebuild it hourly to change the file hash, while the on-device malware abuses Accessibility access to enable wireless debugging, read the ADB pairing code off the screen, and open a shell through Android Debug Bridge.

Why: Two concrete things to act on. First, the on-device chain is Accessibility access → enable wireless debugging → read the pairing code → ADB shell, so if you ship an Android app, that sequence — not generic 'mobile malware' — is what you should test against and consider detecting. Second, hourly rebuilds from the same malware source mean any pipeline relying on file-hash matching to spot known bad apps will miss these; if you use hash-based scanning for sideloaded builds, that gap is now demonstrated at ~100 console deployments. For anyone adding an LLM to a product, the Gemini use here is purely ranking/triage with no write access, which is the low-risk adoption pattern.

Google has filed an appeal at the EU's Court of Justice against a Digital Markets Act decision that would require it to share user search data with rival search engines by January 2027 and modify Android so rival AI services can interoperate with it by July next year. Google argues its systems are already open and interoperable and warns the directives could cause privacy and security problems; the EU's stated goal is more competition.

Why: This is an EU proceeding, and the text does not say whether any Android interoperability changes would apply outside the EU, so nobody should assume new search or assistant APIs reach Malaysia because of this filing. The concrete thing to track is the two dates in the order — search-data sharing by January 2027 and Android changes by July next year — because if they survive appeal they define the first regulated access route to a mobile platform's default AI assistant surface, which is the shape Malaysian Android app and assistant builders would eventually have to plan around.

Samsung's Galaxy Tab S12 Ultra and S12+ go on sale in Malaysia on 7 October 2026, all in a single 12GB/256GB config, with the Ultra at RM5,999 (WiFi) / RM6,649 (5G) and the S12+ at RM4,999 / RM5,649. From 7 October to 8 November 2026 an instant rebate of RM500 (Ultra) or RM400 (S12+) applies when paying with eligible bank cards or SPayLater, dropping the S12+ WiFi to RM4,599, and Samsung bundles a Book Cover Keyboard plus S Pen accessories worth up to RM1,208 and subscriptions worth RM1,123.58 including 6 months of Google AI Pro and 4 months of Adobe Photoshop. Students and education staff can get up to 20% off via the Education Store (.edu email verification), with an extra 5% for first-time education purchases. Both run One UI 9 with MediaTek Dimensity 9500 and Dynamic AMOLED 2X, and are described as the first Android tablets to ship with Adobe Photoshop out of the box.

Why: This is a consumer hardware promo, not a platform change, so it only matters if you were already budgeting for a tablet: the education pricing (S12+ WiFi at RM3,999.20, Ultra WiFi at RM4,799.20, plus 5% first-time discount) and the 7 Oct–8 Nov rebate window are the two levers that change the price, and the rebate requires an eligible bank card or SPayLater. Note the article labels the S12+ price list under 'Galaxy Tab S12 Ultra' headings, so confirm the exact SKU and 5G/WiFi variant with the seller before ordering.

iQOO launched the iQOO 16 in mainland China, its successor to the iQOO 15, running Qualcomm's Snapdragon 8 Elite Extreme Gen 6 — the second phone after the Xiaomi 18 Pro Max to use that chip. It has a 6.85-inch 1440x3168 165Hz AMOLED display, up to 16GB LPDDR5X RAM and 1TB UFS 4.1 storage, a triple 50MP camera setup, IP68/IP69 rating, Android 17, and an 8,400mAh battery (20% bigger than the iQOO 15's 7,000mAh) with 100W wired and 40W wireless charging. China pricing runs CNY5,999 (~RM3,652) for 12GB+256GB up to CNY8,499 (~RM5,174) for 16GB+1TB, with no global availability announced.

Why: Nothing here changes what a Malaysian developer, AI builder, or SaaS founder should build or buy this week — it is a China-only consumer phone launch with no confirmed Malaysian release date or local pricing, and the only signal is the 8,400mAh battery jump, which suggests flagship Android battery capacity is climbing faster than the previous 7,000mAh generation. If you are waiting to replace a work phone, there is no decision to make yet beyond noting the ~RM3,652–RM5,174 China price band as a rough reference for what a Snapdragon 8 Elite Extreme Gen 6 device costs before Malaysian taxes and carrier markup.