This Drozer module analyzes all the applications of the mobile device and checks if any of them contains the permissions needed to be in the Cloak and Dagger attack class. The permissions are SYSTEM_ALERT_WINDOW and BIND_ACCESSIBILITY_SERVICE.
The output will be something like this:
