Chameleon Android Banking Trojan Variant Bypasses Biometric Authentication

**Executive summary:** An evolved Android banking trojan named Chameleon has resurfaced with expanded targeting (U.K., Italy) and enhanced Device Takeover capabilities using Android's accessibility service; it is being distributed via the Zombinder dropper-as-a-service and includes new functionality to prompt Android 13 users to enable accessibility and covertly switch biometric locks to PINs to enable unauthorized unlocking.