The Chameleon Android Malware: Disabling Biometric Unlock Features and Hijacking PIN Codes

The malicious software known as Chameleon disrupts the biometric fingerprint and facial recognition unlock feature on Android devices, utilizing stolen Personal Identification Numbers (PINs), according to TechRadar. Cybersecurity researchers from ThreatFabric Labs have discovered that this malware variant empowers attackers to disable the fingerprint unlock feature and pilfer users’ PIN codes.

Similar to other banking trojans, Chameleon exploits vulnerabilities in the Android accessibility service to steal sensitive information and execute sophisticated attacks. The latest version introduces two significant changes: the ability to fraudulently obtain the device’s PIN and the capability to alter the lock screen to use the stolen PIN instead of facial or fingerprint recognition.

With the new functionality, the malware first checks if the operating system is Android 13 or later. If so, the user is prompted to enable accessibility services, guiding them through the process. Once completed, Chameleon executes unauthorized actions on behalf of the user, as indicated by ThreatFabric researchers: “Upon confirming the presence of Android 13 system settings on the infected device, the banking trojan begins loading an HTML page that guides users through a step-by-step manual process to enable accessibility services for the latest Android 13 versions.