Researchers Detail an Android Toolkit That Feeds Fake Video Into Live KYC Checks

Cybernews researchers have published findings on an Android toolkit built to defeat live identity checks by feeding saved photographs, prerecorded video or a remotely controlled stream into a verification app as though the imagery were coming from the phone’s camera.

The tool operates at the device level rather than inside the verification application, which is what makes the injected imagery look like an ordinary camera capture.

Most remote verification flows use both cameras. The rear camera photographs an identity document, then the app switches to the front camera for a selfie and a liveness or face-match check. The toolkit can drive the two separately, supplying a document image to the rear camera while a separate face video goes to the front. Its components emulate ordinary camera behaviour, including movement and timing.

The tool can also alter what the phone reports about itself, including its model, location, identifiers, browser characteristics and security state.

The researchers said the setup may not have been widely used or downloaded. It requires an unlocked Android device with root access and extensive system modifications, not an app an ordinary user can install. A phone configured that way carries weaker protections and could expose the operator’s own information, so it is likely run on a dedicated handset. Once prepared, though, the same device could be turned against multiple verification services.

Cybernews said it found no evidence that any identity verification provider accepted a fraudulent identity through the toolkit, and noted that verification processes differ between companies. Providers can combine camera input with document authenticity checks, unpredictable liveness challenges, device analysis, fraud scoring, reused-identity detection and manual review.

The evidence collected includes deployable root modules, APKs, native binaries, device databases, attestation and keybox material, operational scripts and identity media. Cybernews is withholding the complete specimen and deployment details.

Its recommendations to verification providers include using server-generated, inquiry-specific challenges with controls for freshness and replay, comparing optical movement in the camera scene against accelerometer and gyroscope data, and validating Play Integrity or app attestation on the server with a fresh nonce. It advised treating a positive attestation as one risk signal rather than proof that a camera feed is genuine, and not treating Camera2, WebRTC or disabled uploads as evidence of physical capture.

The technique belongs to a class of attacks ID Tech surveyed in a July feature on deepfakes and injection attacks. Reality Defender showed a related weakness earlier this month when it enrolled a synthetic face in a Google selfie sign-in test.

Sources: Cybernews

–

By Ali Nassar-Smith