Android Malware Chameleon Upgrade
Yep, just like regular software, even malware gets updated
What is Chameleon Malware
In early 2023 Chameleon Malware was detected in the banking industry, specifically targeting banking apps.
It’s classified as a Trojan, meaning it hides itself in other pieces of legitimate software and later executes it’s code and infects the device it’s on.
How does your device become infected?
Originally it would typically attach itself to common Android apps such as Google Chrome. It can even bypass Google’s protective functions and mimic the original app by continuing to provide some of the services you expect the app to provide.
However, with later versions of Android, that have a more robust app permission setup, Chameleon will redirect you to a web browser and that page will request you give permission.
Chameleon’s multi vector attack
Here, in no particular order are the six main attack vectors
Disabling the finger print and face unlock feature. Thus allowing the hackers direct access to your device
PIN theft, yep, as if disabling the finger print and face recognition wasn’t enough, it can capture and use your pin number
Overlay attacks, think of it like Phishing, it produces a fake window that looks nearly identical and seemingly performs normally, to the originally intended app.
Service abuse, basically it hijacks the accessibility features
Bypass restricted settings, even on devices running Android 13 or later
And my personal favorite, App usage collector. Basically it monitors when you regularly use your phone and sets itself to run on the times you are not using your phone, such as when you are sleeping!
What can you do about it?
You can start off by only installing apps from the Google Play Store. While even this isn’t 100% safe 100% of the time, it’s your best option.
You can also install antivirus software.
Also don’t enable accessibility permission for unknown or suspicious apps. If you run into a specific situation where you need to do this for a particular app, do it in your device settings and not the browser or pop up window when installing the app.