Chameleon Android Malware Discovered in the Wild, Threatening Mobile Devices

Cyble Research & Intelligence Labs (CRIL) recently discovered a new strain of Android Banking Trojan, named “Chameleon,” which appears to be unrelated to any known Trojan families.

The malware is identified based on the commands used by the Trojan. The Trojan has been active since January 2023 and is observed specifically targeting users in Australia and Poland.

The Trojan is designed to carry out malicious activities by utilizing the Accessibility Service, similar to other Banking Trojans. The malware is capable of impersonating popular cryptocurrency app CoinSpot, a government agency in Australia, and IKO bank from Poland. This impersonation allows the Trojan to deceive unsuspecting victims and gain access to sensitive information.

The Chameleon Banking Trojan employs various evasion techniques upon launch to avoid detection by security software. These evasion techniques include anti-emulation checks, which can detect if the device is rooted or if debugging is enabled. This is done to increase the likelihood that the app is running in an analyst’s environment.

It can also disable Google Play Protect and prevent the user from uninstalling it. Upon initial connection with the Command-and-Control server (C2), Chameleon sends crucial device information such as the device version, model, root status, country, and precise location. This information is likely used to profile the new infection.

This Trojan loads malicious modules in the background depending on the entity it impersonates. These modules include a cookie stealer, keylogger, phishing page injector, lock screen PIN/pattern grabber, and SMS stealer.

The Accessibility Service is abused to carry out these data-stealing activities, allowing the malware to monitor screen content, intervene to modify interface elements, or send certain API calls as needed. The service is also used to prevent the malware from being uninstalled by identifying removal attempts and deleting shared preference variables.

The Trojan is considered an emerging threat, and future versions may have additional features and capabilities. Android users are advised to exercise caution when downloading apps, use only official app stores, and keep Google Play Protect enabled at all times.