Chameleon Android Malware Poses Threat to Fingerprint Unlock, Steals PINs
The Chameleon Android malware has been updated to bypass fingerprint security features and steal PINs instead. Researchers from ThreatFabric discovered that the malware can trick users into enabling accessibility services, allowing attackers to change the phone's lock type from biometric to PIN. The malware disguises itself as legitimate Android apps and displays an HTML page asking victims to turn on accessibility settings. Once the accessibility services are enabled, attackers can bypass protections, including fingerprint unlock. The malware can steal PINs or passwords entered after the victim has turned off their fingerprint lock. People should be cautious when using apps, especially banking apps, and ensure they are using legitimate sources. The malware has evolved to bypass biometric security measures such as fingerprint and facial recognition. It uses a proxy feature and abuses Accessibility Services to perform actions on behalf of the victim, allowing attackers to engage in Account Takeover (ATO) and Device Takeover (DTO) attacks. The malware is being distributed through phishing pages, posing as legitimate applications, and using a legitimate content distribution network (CDN) for file distribution. The new variant of the malware has been observed targeting mobile banking applications in Australia, Poland, UK, and Italy. The malware features advanced capabilities such as device-specific checks to target 'Restricted Settings' protections introduced in Android 13, and interrupting biometric operations to bypass biometric security measures. Task scheduling using the AlarmManager API is also used.