Central Idea
- Security researchers have identified an updated version of the ‘Chameleon Trojan’ malware, capable of disabling biometric authentication methods.
Chameleon Trojan
- The malware’s primary objective is to steal the phone’s PIN by bypassing fingerprint and face unlock security features.
- This trojan attaches itself to legitimate Android applications, such as Google Chrome, to evade detection.
- It operates in the background and is reportedly undetectable during runtime, bypassing Google Protect alerts and other security software.
- It exploits the Accessibility service on Android 12 and earlier versions, while on newer versions, it circumvents Google’s security restrictions through different methods.
Modus Operandi of Chameleon Trojan
- To bypass new restrictions, the malware displays an HTML page instructing users to enable the Accessibility service for the app, compromising device security.
- Once active, it captures on-screen content, navigates using gestures, and steals PINs and passwords, subsequently accessing more sensitive data like credit card details and login credentials.
- The malware also tracks app usage habits to time its attacks when the device is least likely to be in use.
Protection against Chameleon Trojan
- Users are advised to avoid installing Android apps from unofficial sources to reduce the risk of malware infection.
- Be wary of enabling the Accessibility service for apps that are not well-known or trusted.
- Conducting regular security scans on the device can help in identifying and mitigating threats.
- Ensuring that Google Play Protect is enabled at all times is recommended for continuous monitoring and protection against malware.
