Data Card
Researchers detail an Android toolkit that feeds fake video into live KYC checks
Cybernews researchers documented an Android toolkit that feeds saved photographs, prerecorded video, or a remotely controlled stream into a verification app as though it came from the phone camera.
2026-08-28CC-BY-4.0injection-attacksrooted-devicesliveness-bypasskyc
About
Key Facts
- The toolkit injects prerecorded media or remote streams into the camera subsystem on rooted devices.
- It can spoof hardware signatures, location data, and security profiles.
- Researchers found no evidence of widespread production exploitation and recommend server-side dynamic liveness challenges and hardware nonce verification.
Card Text
Injection attacks bypass the camera rather than fool it, so presentation attack detection tuned for physical spoofs does not address them. The recommended countermeasures move trust to the server and to device attestation, since anything the handset reports about itself is under attacker control.