Chameleon Android Trojan Poses as CRM App to Target Hospitality Employees
Summary
ThreatFabric reports Chameleon campaigns targeting employees in Canada and Europe. A dropper bypasses Android 13+ restrictions, installs the Trojan, and uses fake CRM prompts to obtain employee credentials; Chameleon can also keylog.
Key points
- ThreatFabric observed campaigns targeting Canada and Europe, including a Canadian restaurant chain operating internationally.
- The malware masqueraded as a CRM app, with file names suggesting hospitality workers and other B2C business employees were targeted.
- A multi-stage dropper bypasses Android 13+ restrictions to install the Chameleon payload.
- Fake CRM screens request an Employee ID and later employee credentials; the credential page showed an error after submission at the time of reporting.
- Once running, Chameleon can collect credentials and other sensitive information through keylogging.
- ThreatFabric also observed Chameleon targeting customers of specific financial organizations while posing as a security app that installed a bank-released certificate.
Article Details
- Event Type
- Android banking Trojan campaign using a CRM-app disguise and a multi-stage dropper
- Impact
- Chameleon targeted hospitality employees, including employees of a Canadian restaurant chain operating internationally, and potentially other B2C business employees. Its dropper bypasses Android 13+ restrictions, installs the malware, and presents fake CRM login pages to collect employee credentials. Chameleon can also capture credentials and other sensitive information through keylogging, potentially exposing business banking accounts. ThreatFabric separately observed attacks on customers of specific financial organizations, with Chameleon masquerading as a security app. The report says the fake website displayed an error after credentials were submitted.