LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1083: Chameleon

Chameleon is an Android banking trojan that can leverage Android’s Accessibility Services to perform malicious activities. Believed to have been first active in January 2023, Chameleon has been observed targeting users in Australia and Poland by masquerading as official applications. A new variant of Chameleon has expanded its targets to include Android users in the United Kingdom and Italy.[1][2]

MobileS1083MalwareObject v2.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

S1083: Chameleon describes [Chameleon](https://attack.mitre.org/software/S1083) is an Android banking trojan that can leverage Android’s Accessibility Services to perform malicious activities. Believed to have been first active in January 2023, [Chameleon](https://attack.mitre.org/software/S1083) has been observed targeting users in Australia and Poland by masquerading as official applications. A new variant of [Chameleon](https://attack.mitre.org/software/S1083) has expanded its targets to include Android users in the United Kingdom and Ita...

Executive priority

S1083: Chameleon is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S1083: Chameleon by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Android), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata

Detection direction

  • Validate whether S1083: Chameleon appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Chameleon

Chameleon is an Android banking trojan that can leverage Android’s Accessibility Services to perform malicious activities. Believed to have been first active in January 2023, Chameleon has been observed targeting users in Australia and Poland by masquerading as official applications. A new variant of Chameleon has expanded its targets to include Android users in the United Kingdom and Italy.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

26 rows
DomainIDNameRelationship / procedure
MobileT1575Native API

Chameleon has used the KeyguardManager API to evaluate the device’s locking mechanism and the AlarmManager API to schedule tasks.[2]

MobileT1630Indicator Removal on Host

Chameleon has removed artifacts of its presence and has the ability to uninstall itself.[1]

MobileT1426System Information Discovery

Chameleon has the ability to gather basic device information, such as version, model, root status, and country.[1] Chameleon has also checked the restricted settings status of the device. If the Android 13 Restricted Settings status is present, an HTML page with instructions on how to enable the Accessibility Service will be shown to the user. Additionally, Chameleon has checked the keyguard’s status regarding how the device is locked (e.g. pattern, PIN or password).[2]

MobileT1453Abuse Accessibility Features

After accessibility permissions are granted, Chameleon has used the Accessibility Service to perform a variety of actions, such as switching from biometric authentication to PIN authentication, automatically granting additional permissions, preventing uninstallation, disabling Play Protect.[1][2]

MobileT1533Data from Local System

Chameleon has gathered cookies and device logs.[1][2]

MobileT1603Scheduled Task/Job

Chameleon has used the AlarmManager API to schedule tasks.[2]

MobileT1616Call Control

Chameleon has the ability to control calls.[2]

MobileT1660Phishing

Chameleon has been distributed using phishing links and a Content Distribution Network (CDN) for file distribution.[2]

MobileT1544Ingress Tool Transfer

Chameleon has downloaded HTML overlay pages after installation.[1]

MobileT1633.001System ChecksSub-technique

Chameleon has performed system checks to verify if the device is rooted or has ADB enabled; if found, Chameleon will avoid execution.[1]

MobileT1437Application Layer Protocol

Chameleon has used a SOCKS proxy.[2]

MobileT1437.001Web ProtocolsSub-technique

Chameleon has used HTTP to communicate with the C2 server.[1]

MobileT1509Non-Standard Port

Chameleon has communicated over port 7242 using HTTP.[1]

MobileT1430Location Tracking

Chameleon has gathered device location data.[1]

MobileT1646Exfiltration Over C2 Channel

Chameleon has sent stolen data over HTTP.[1]

MobileT1655.001Match Legitimate Name or LocationSub-technique

Chameleon has disguised itself as legitimate applications, such as a cryptocurrency application called ‘CoinSpot,’ the IKO banking application in Poland, and an application used by the Australian Taxation Office (ATO). It has also used familiar icons, such as the Chrome and Bitcoin logos.[1][2]

MobileT1517Access Notifications

Chameleon has registered as an `SMSBroadcast` receiver to monitor incoming SMS messages.[1]

MobileT1418Software Discovery

Chameleon has read the name of application packages.[1]

MobileT1636.004SMS MessagesSub-technique

Chameleon has gathered SMS messages.[1]

MobileT1417.002GUI Input CaptureSub-technique

Chameleon has performed overlay attacks against a device by injecting HTML phishing pages into a webview.[1] Chameleon has launched overlay attacks through the “Injection” activity.[2]

MobileT1417.001KeyloggingSub-technique

Chameleon has logged keystrokes of an infected device.[1] Additionally, Chameleon has stolen PINs, passwords and graphical keys through keylogging functionalities.[2]

MobileT1513Screen Capture

Chameleon has captured the device’s screen.[2]

MobileT1629.001Prevent Application RemovalSub-technique

Chameleon has prevented application removal by abusing Accessibility Services.[1][2]

MobileT1407Download New Code at Runtime

Chameleon has the ability to download new code at runtime.[1]

MobileT1461Lockscreen Bypass

Chameleon has the ability to bypass the biometric prompt for unlocking an infected device, forcing the victim to use PIN authentication. To do so, Chameleon will first check specified conditions, then will use the AccessibilityEvent action to transition from biometric authentication to PIN authentication.[2]

MobileT1629.003Disable or Modify ToolsSub-technique

Chameleon has the ability to disable Google Play Protect.[1][2]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1575: Native APIMobileuses · TechniqueT1630: Indicator Removal on HostMobileuses · TechniqueT1426: System Information DiscoveryMobileuses · TechniqueT1453: Abuse Accessibility FeaturesMobileuses · TechniqueT1533: Data from Local SystemMobileuses · TechniqueT1603: Scheduled Task/JobMobileuses · TechniqueT1616: Call ControlMobileuses · TechniqueT1660: PhishingMobileuses · TechniqueT1544: Ingress Tool TransferMobileuses · TechniqueT1633.001: System ChecksMobileuses · TechniqueT1437: Application Layer ProtocolMobileuses · TechniqueT1437.001: Web ProtocolsMobileuses · TechniqueT1509: Non-Standard PortMobileuses · TechniqueT1430: Location TrackingMobileuses · TechniqueT1646: Exfiltration Over C2 ChannelMobileuses · TechniqueT1655.001: Match Legitimate Name or LocationMobileuses · TechniqueT1517: Access NotificationsMobileuses · TechniqueT1418: Software DiscoveryMobileuses · TechniqueT1636.004: SMS MessagesMobileuses · TechniqueT1417.002: GUI Input CaptureMobileuses · TechniqueT1417.001: KeyloggingMobileuses · TechniqueT1513: Screen CaptureMobileuses · TechniqueT1629.001: Prevent Application RemovalMobileuses · TechniqueT1407: Download New Code at RuntimeMobile
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.2
Object version
2.0
Created
Modified
Raw hash
44cf07b1079604a9...
Imported snapshots across ATT&CK releases(2)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.22.0Current bundle44cf07b10796…
19.12.0Older bundle44cf07b10796…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    cyble_chameleon_0423

    Cyble Research & Intelligence Labs. (2023, April 13). Banking Trojan targeting mobile users in Australia and Poland. Retrieved August 16, 2023.

    Open source URL
  2. [2]
    ThreatFabric_Chameleon_Dec2023

    ThreatFabric. (2023, December 21). Android Banking Trojan Chameleon can now bypass any Biometric Authentication. Retrieved July 7, 2025.

    Open source URL
  3. [3]
    mitre-attackS1083
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use