Central Idea

Security researchers have identified an updated version of the ‘Chameleon Trojan’ malware, capable of disabling biometric authentication methods.

Chameleon Trojan

The malware’s primary objective is to steal the phone’s PIN by bypassing fingerprint and face unlock security features.
This trojan attaches itself to legitimate Android applications, such as Google Chrome, to evade detection.
It operates in the background and is reportedly undetectable during runtime, bypassing Google Protect alerts and other security software.
It exploits the Accessibility service on Android 12 and earlier versions, while on newer versions, it circumvents Google’s security restrictions through different methods.

To bypass new restrictions, the malware displays an HTML page instructing users to enable the Accessibility service for the app, compromising device security.
Once active, it captures on-screen content, navigates using gestures, and steals PINs and passwords, subsequently accessing more sensitive data like credit card details and login credentials.
The malware also tracks app usage habits to time its attacks when the device is least likely to be in use.

Users are advised to avoid installing Android apps from unofficial sources to reduce the risk of malware infection.
Be wary of enabling the Accessibility service for apps that are not well-known or trusted.
Conducting regular security scans on the device can help in identifying and mitigating threats.
Ensuring that Google Play Protect is enabled at all times is recommended for continuous monitoring and protection against malware.