iProov says a mobile KYC attack scenario demonstrated by its internal red team has been accepted into MITRE ATLAS, highlighting how certain remote identity verification flows can be bypassed when attackers are able to inject synthetic video directly into the camera pipeline. The case study combines real-time face-swap deepfake generation with camera injection on Android, targeting mobile onboarding and account access processes used across financial services, banking, and cryptocurrency platforms.
According to iProov, the attack does not rely on presenting spoof artifacts to a physical camera. Instead, it replaces the live camera feed at the software level, allowing synthetic video to be fed upstream of liveness detection and biometric analysis. The company describes the scenario as a "defeat the sensor" attack, in which the integrity of the camera path itself is compromised.
The toolchain outlined in iProov’s write-up includes real-time face-swap software, OBS for video streaming, and an Android virtual camera application called Virtual Camera: Live Assist. iProov states that this virtual camera approach can operate on non-rooted Android devices, increasing the practicality of the attack against real-world mobile KYC deployments. In the scenario described, the injected video enables an attacker to complete onboarding or gain account access under a fictitious identity, even when active liveness checks are in place.
MITRE ATLAS is a publicly available knowledge base focused on adversarial threats to AI-enabled systems. iProov says the inclusion of this scenario as a published case study reflects MITRE’s emphasis on incorporating community and red-team contributions to improve defensive understanding. In its announcement, MITRE highlights the value of real-world attack research in strengthening security guidance for AI-driven technologies.
iProov also points to European standard CEN 18099 as a relevant benchmark for evaluating resistance to camera injection attacks in remote identity verification. The company positions the standard as a concrete procurement and testing reference for organizations deploying mobile KYC solutions, particularly in regulated environments.
The case study underscores a shift in threat models for biometric onboarding. The risk is not limited to presentation attacks against liveness algorithms, but extends to the trust assumptions around mobile sensors and capture pipelines themselves. As mobile KYC continues to scale, iProov argues that resilience to injection attacks must be explicitly tested rather than assumed.
Sources: iProov, MITRE ATLAS
—
By the ID Tech Editorial Team
