In a recent cybersecurity development, a new strain of Android malware named Chameleon has emerged as a significant threat. This malicious software employs a sophisticated tactic, disabling fingerprint unlock mechanisms to surreptitiously steal PINs from unsuspecting users.

Based on the commands used by the malware that powers it, security researchers have named this banking trojan “Chameleon,” according to a report from the cybersecurity company Cyble.

Since January of this year, the Chameleon banking trojan has been in operation. Like other Android malware, it takes advantage of the operating system’s Accessibility Service to carry out harmful operations. But what distinguishes Chameleon from other banking trojans is its ability to impersonate other well-known apps and even alter its icon to blend in with the background.

Unraveling Chameleon’s Tactics

Researchers at ThreatFabric, who have been following the malware, report that it is currently distributed via the Zombinder service, posing as Google Chrome.

Chameleon takes a strategic approach to compromise Android devices, with its primary focus on disabling the fingerprint unlock functionality. By rendering this layer of security ineffective, the malware gains a pathway to exploit user PINs, putting sensitive information at risk.

Experts believe that Chameleon’s ability to operate in stealth mode, avoiding detection by conventional security measures, contributes to its success in infiltrating devices. This has raised concerns among cybersecurity professionals who are now intensifying efforts to counteract this evolving threat.

So far, Cyble’s researchers have observed the banking trojan using the icons of ChatGPT, Chrome, and other apps though it also uses pictures of popular cryptocurrencies like Bitcoin or Litecoin to disguise itself as well.

The Impact on User Security

As Chameleon discreetly sidesteps fingerprint protection, users are left vulnerable to PIN theft, potentially leading to unauthorized access to personal accounts, sensitive data, and financial information. The malware’s capability to adapt and avoid detection poses a significant challenge for security protocols, demanding swift action to protect users.

Android users are urged to remain vigilant and update their security software regularly to safeguard against evolving threats like Chameleon. Staying informed about the latest cybersecurity developments is crucial in the ongoing battle against malicious actors seeking to exploit vulnerabilities in digital systems.

Stealing account info and disabling Google Play Protect

Based on Cyble’s investigation, it appears that malicious apps used to spread the Chameleon banking trojan are distributed through hacked websites, Discord attachments and Bitbucket hosting services.

Even though Chameleon is still relatively new and is in the early stages of development, it already has a wide range of malicious capabilities and the banking trojan can perform keylogging, launch overlay attacks, harvest SMS text messages, prevent itself from being uninstalled, steal cookies and automatically uninstall itself.

One thing that makes this new malware strain particularly dangerous is that it can disable Google Play Protect on an infected smartphone. For those unfamiliar, Google Play Protect is Google’s own Android antivirus app which scans both your existing apps and any new apps you download for malware and removes them.

Another interesting capability already found in Chameleon is its lock grabber which can steal a victim’s device password. Surprisingly, the lock grabber can even identify whether you’re using a password, PIN, or even a swipe pattern before saving the password used to unlock your Android smartphone.

How to stay safe from banking trojans and other Android malware

At the moment, the Chameleon banking trojan is primarily being used to target Android users in Australia by disguising itself as a legitimate cryptocurrency exchange called CoinSpot. However, at the end of its report on the matter, Cyble notes that there is certainly potential for the malware behind it to become more sophisticated over time with new features as it expands its target base to users in other countries.

To protect yourself from the Chameleon banking trojan and other Android malware, installing one of the best Android antivirus apps is your best bet since this new malware strain is capable of getting around the protection offered by Google Play Protect. At the same time, you should avoid sideloading apps and instead, you should only download

Since Chameleon steals PINs and other forms of Android lock screen passwords, you’re better off using biometrics like your fingerprint or facial recognition to unlock your phone. Likewise, you want to be cautious about opening links received via text messages or emails from unknown senders on your smartphone.