Chameleon Malware Poses as CRM App

Researchers at ThreatFabric warn that a phishing campaign is distributing the Chameleon Android malware by impersonating a Customer Relationship Management (CRM) app. The campaign is currently targeting users in Canada and Europe, but may expand to other regions.

“The naming used for the dropper and the payloads clearly shows that the intended victims of the campaign are hospitality workers and potentially B2C business employees in general,” ThreatFabric says.

“If the attackers succeed in infecting a device with access to corporate banking, Chameleon gets access to business banking accounts and poses a significant risk to the organisation. The increased likelihood of such access for employees whose roles involve CRM is the likely reason behind the choice of the masquerading during this latest campaign.”

Once the malware is installed, it continues to use social engineering to gain additional privileges on the device.

“Once loaded, the dropper displays a fake page masquerading as a CRM login page, requesting the Employee ID,” the researchers write. “Then a message asking to reinstall the application pops up, when in actual fact it installs a Chameleon payload, bypassing Android 13+ AccessibilityService restrictions.

After installation, a fake website is loaded, again asking for the credentials of the employee. At the time of writing this report, after submitting the credentials, an error message was displayed. Because Chameleon is already running in the background, it is also able to collect credentials and other sensitive information using keylogging.”

ThreatFabric concludes that “financial organisations can take preventive steps and educate business customers about potential impacts of mobile banking malware like Chameleon and the consequences it brings landing on a mobile device with access to business banking accounts.”

KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

ThreatFabric has the story.