Chameleon Banking Trojan
Cybersecurity researchers discover an updated Chameleon Android banking malware.
Chameleon Banking Trojan
The evolved variant now expands its targeting to include users in the U.K. and Italy.
Chameleon Banking Trojan
Chameleon excels in Device Takeover (DTO) using Android's accessibility service.
Chameleon Banking Trojan
New features demonstrate increased resilience and advanced capabilities.
Chameleon Banking Trojan
Delivered via Zombinder, an off-the-shelf dropper-as-a-service.
Chameleon Banking Trojan
Zombinder is used to bind malicious payloads to legitimate apps, facilitating malware distribution.
Chameleon Banking Trojan
Malicious artifacts masquerade as the Google Chrome web browser.
Chameleon Banking Trojan
Package names include Z72645c414ce232f45.Z35aad4dde2ff09b48 and com.busy.lady.
Chameleon Banking Trojan
Chameleon prompts users to enable accessibility service, targeting Android 13 and later versions.
Chameleon Banking Trojan
Uses Android APIs to transition the lock screen authentication to a PIN, enabling unauthorized device unlocking.
Chameleon Banking Trojan
Chameleon targets users in various countries, with a focus on the U.S., U.K., Italy, Australia, and others.
Chameleon Banking Trojan
Financial services apps like PhonePe, WeChat, Bank of America, and Barclays are among the prime targets.
Chameleon Banking Trojan
Chameleon's evolution showcases the sophisticated and adaptive nature of the Android malware landscape.
Chameleon Banking Trojan
New features and resilient tactics pose challenges for cybersecurity defenders.