Watch out - this devious new Android malware impersonates banks and governments to trick you out of your crypto

Samsung Galaxy S23 hands on display macro
The Google Play Store on Samsung's Galaxy S23 (Image credit: Future | Alex Walker-Todd)

Cybersecurity researchers have recently discovered a new malware for Android that successfully mimics different kinds of mobile applications - from banking apps, to crypto exchange apps, to government apps.

Chameleon was discovered by researchers from Cyble, who observed hackers distributing the malware through compromised websites, Discord channels, and Bitbucket hosting services. 

The tool sports a number of different functionalities, all of which amount to information stealing. 

Profiling the target

Once downloaded, the malware will first analyze the device to see if it’s in a honeypot. It will scan the phone to see if it’s rooted and if debugging is activated, as these are usual signals of an analyst’s environment. Once that test is passed, it will ask for Accessibility Service permissions - which is a huge red flag. It’s usually malware that asks for this kind of permission as they allow it to run rampant across the endpoint.

The next step is to establish a connection with its Command & Control (C2) server, and send the basic device information: version, model, root status, country, and precise location. After that, it will start loading different malicious modules to the device, including a cookie stealer, a keylogger, a phishing pages injector, a grabber for PIN codes and patterns, and an SMS stealer. These modules allow the malware to grab passwords and multi-factor authentication codes which can later be used for identity theft.

While all of this might sound like much, researchers are adding that Chameleon is an emerging threat, and as such is likely to get additional features in the comping weeks. 

To stay safe, Android users should first make sure not to download apps from suspicious sources and instead grab apps only from official stores. Furthermore, they should enable Google Play Protect, as the first line of defense. An Android antivirus program wouldn’t hurt, either.

Via: BleepingComputer

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
Malware worm
Coordinated global mobile malware campaign targets banking apps and cryptocurrency platforms
Android phone malware
Screen reading malware found in iOS app stores for first time - and it might steal your cryptocurrency
Android phone malware
This nasty Android malware is posing as the Telegram Premium app
HTTPS in a browser address bar
Malicious "polymorphic" Chrome extensions can mimic other tools to trick victims
An Android phone being held in the hand
Google is ramping up Android security protection with new Android app safety tools
DeepSeek
Fake DeepSeek installers are infecting your device with dangerous malware
Latest in Security
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
Google Chrome
Google Chrome security flaw could have let hackers spy on all your online habits
cybersecurity
Chinese government hackers allegedly spent years undetected in foreign phone networks
Data leak
A major Keenetic router data leak could put a million households at risk
Latest in News
A young woman is working on a laptop in a relaxed office space.
I’ll admit, Microsoft’s new Windows 11 update surprised me with its usefulness, providing accessibility fixes, a gamepad keyboard layout, and PC spec cards
inZOI promotional material.
inZOI has become the most wishlisted game on Steam, but I wouldn't get too caught up in the hype
Xbox Series X and Xbox wireless controller set to a green background
Xbox Insiders are currently testing a new Game Hub feature that looks useful, but I've got mixed feelings about it
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Microsoft Surface Laptop and Surface Pro devices on a table.
Hate Windows 11’s search? Microsoft is fixing it with AI, and that almost makes me want to buy a Copilot+ PC
Oura Ring 4
Activity tracking on Oura Ring is about to get a whole lot better, but I've got bad news about your step count