Once installed, malicious applications can abuse accessibility, notification and other permissions to monitor activity, and read OTPs.