Updated Chameleon Android Trojan Uses Accessibility to Bypass Biometric Prompts
Summary
ThreatFabric analyzes an updated Chameleon banking trojan distributed via Zombinder. The malware targets Android users, including in the UK and Italy, and can interrupt biometric prompts, prompt users to enable accessibility, and support device takeover.
Key points
- ThreatFabric reports that the updated Chameleon variant is distributed via Zombinder and often masquerades as Google Chrome.
- The researchers say the variant has expanded its targeting to Android users in the UK and Italy.
- On Android 13 devices with Restricted Settings, the malware can display an HTML guide prompting users to enable its required Accessibility Service.
- A command called "interrupt_biometric" triggers a method that, according to the analysis, switches biometric authentication to PIN, pattern, or password authentication.
- The malware can use Accessibility actions and keylogging to support credential theft and device takeover; the report says attackers do not gain access to victims' biometric data.
- A new scheduling feature can use accessibility or usage statistics to identify the foreground app and decide whether to launch an overlay or injection activity.
Article Details
- Attack Vectors
- Chameleon is distributed through Zombinder in a two-stage payload process that deploys Chameleon samples along with the Hook malware family.
- The trojan is distributed through phishing pages that disguise it as legitimate applications, including Google Chrome.
- Chameleon abuses Android Accessibility Service privileges to perform device-takeover actions, manipulate authentication, and launch overlay attacks.
- When accessibility is disabled, the malware can use usage statistics to identify the foreground application and decide whether to initiate an overlay or injection activity.
- A command from its C2 server can prompt users on restricted Android 13 devices with an HTML page instructing them to enable Accessibility Service.
- Defensive Notes
- Treat requests to enable Accessibility Service from unexpected applications as suspicious, particularly on Android 13 and higher.
- Monitor for banking trojans that use accessibility actions to interfere with biometric prompts or fall back to PIN, password, or pattern authentication.
- The article identifies Chameleon samples by SHA-256 hashes in its IOC appendix.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 0a6ffd4163cd96d7d262be5ae7fa5cfc3affbea822d122c0803379d78431e5f6 | SHA-256 hash listed for a new Chameleon variant sample named Chrome. |
| SHA256 | 2211c48a4ace970e0a9b3da75ac246bd9abaaaf4f0806ec32401589856ea2434 | SHA-256 hash listed for a new Chameleon variant sample named Chrome. |
MITRE ATT&CK
T1411Chameleon launches overlay attacks against targeted applications when its accessibility-based mode is enabled.T1417.002The trojan uses keylogging functionality to capture PINs, passwords, or graphical keys after forcing fallback from biometric authentication.T1433The malware checks installed app package names and uses foreground-app information to decide whether to initiate an overlay or injection activity.T1656 · ImpersonationChameleon disguises itself as legitimate applications, including Google Chrome, to facilitate distribution.
Malware
ChameleonIn January 2023, the Chameleon Banking Trojan emerged as a significant threat, employing various distribution methods to infiltrate the Android ecosystem, with a specific focus on users in Australia and Poland.HookThey employ the SESSION_API through PackageInstaller, deploying the Chameleon samples along with the Hook malware family.ZombinderIn line with our earlier research (see also our SecuriDropper blog), during this investigation we were able to track and analyze samples related to the updated Zombinder.
Products
Countries
AustraliaIn January 2023, the Chameleon Banking Trojan emerged as a significant threat, employing various distribution methods to infiltrate the Android ecosystem, with a specific focus on users in Australia and Poland.ItalyThis new variant has also expanded its target region to include Android users in the United Kingdom (UK) and Italy.PolandIn January 2023, the Chameleon Banking Trojan emerged as a significant threat, employing various distribution methods to infiltrate the Android ecosystem, with a specific focus on users in Australia and Poland.United KingdomThis new variant has also expanded its target region to include Android users in the United Kingdom (UK) and Italy.