Researchers detail an Android toolkit that feeds fake video into live KYC checks
Cybernews researchers documented an Android toolkit that feeds saved photographs, prerecorded video, or a remotely controlled stream into a verification app as though it came from the phone camera.
- The toolkit injects prerecorded media or remote streams into the camera subsystem on rooted devices.
- It can spoof hardware signatures, location data, and security profiles.
- Researchers found no evidence of widespread production exploitation and recommend server-side dynamic liveness challenges and hardware nonce verification.