CHAMELEOSCAN: Demystifying and Detecting iOS Chameleon Apps via LLM-Powered UI Exploration

CHAMELEOSCAN: Demystifying and Detecting iOS Chameleon Apps via LLM-Powered UI Exploration

Speakers: Hongyu Lin

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=yA0DlwK1Kes

Overview

Hongyu Lin (presenting as co-first author) from Zhejiang University introduces ChameleoScan, the first LLM-powered automated detection system for iOS chameleon apps -- applications that appear legitimate during app store review but reveal hidden illicit functionality after installation. Through a systematic study of 500 manually collected chameleon samples, the researchers built the first taxonomy of 10 transformation methods across 4 categories. ChameleoScan uses LLM-driven UI exploration to dynamically trigger and detect transformations, achieving 100% precision (zero false positives) with approximately 96% recall on known samples, and discovering 150 new chameleon apps plus 128 additional suspicious apps on live app stores. Each app analysis costs approximately $0.10 and takes about 2 minutes, making the system practical for large-scale deployment.

Background

▶ Watch: What are chameleon apps: benign review, illicit post-install (0:30)

Chameleon apps represent a unique mobile security threat: they pass app store review by presenting benign functionality (calculators, puzzle games, health trackers) but transform into illicit platforms (pirated movie streaming, gambling, unauthorized financial services) after users input specific codes, visit certain pages, or trigger time-based conditions. The transformation methods are distributed covertly while the app store page appears completely normal.

Two prior approaches exist. Chameleon Hunter relies on static code and UI analysis but fails on apps built with dynamic frameworks like Flutter, WebView, or React Native (approximately 60% of collected samples). Mask Catcher relies on metadata analysis and code similarity but fails when apps have limited metadata or no recognizable code patterns. Neither approach can handle the full diversity of modern chameleon apps, motivating a dynamic behavior analysis approach.

Key Findings

▶ Watch: Taxonomy: 10 transformation methods across 4 categories (4:00)

First taxonomy of transformation methods: 10 distinct types across 4 categories: auto transformation (triggering on launch or at specific times like midnight), spill temperature-based (environmental triggers), click-based (UI element interaction), and input-based (specific codes or text entry -- the largest group).

100% precision, ~96% recall: On a verified benchmark of 234 chameleon apps and 233 benign apps, ChameleoScan produced zero false positives. Under ideal conditions, it detected approximately 96% of chameleon apps with an average of 2.26 LLM interaction rounds per app.

150 new chameleon apps discovered: On an unknown dataset of 1,644 app store apps collected over one month, ChameleoScan identified 150 confirmed chameleon apps after human review, plus 128 additional apps showing similar behavioral patterns (automatic redirection to external websites for gambling or financial services upon launch).

60% of samples evade static analysis: Approximately 60% of the collected chameleon apps use Flutter, WebView, or React Native -- frameworks that defeat static code analysis approaches like Chameleon Hunter.

Cost-effective at scale: Average processing time of 2 minutes per app with a total cost of approximately $0.10, making systematic app store scanning financially viable.

Technical Deep Dive

▶ Watch: Core reasoning: chain-of-thought LLM decision making (8:00)

ChameleoScan's seven-module pipeline begins with Transformation Intelligence Synthesis (Module 1), which combines app metadata (bundle IDs, descriptions, user reviews) with known chameleon patterns to generate structured prompts. Transformation Method Inference (Module 2) uses an LLM to output candidate transformation methods with confidence scores and rationale.

For each candidate, the system enters an iterative exploration loop. UI Data Acquisition and Enhancement (Module 3) collects both visual screenshots and structural view hierarchies, applying tree pruning to remove noise and semantic segmentation to add meaning to icons and images. UI Comprehension (Module 4) feeds enhanced data to an LLM to produce structured descriptions of all meaningful UI elements including type, interactability, and functional description.

Decision Making and Action Sequence Generation (Module 5) is the core reasoning component. The LLM evaluates test progress, analyzes recent actions, decides the next subtest, and generates action sequences through chain-of-thought reasoning designed for fine-grained UI navigation. Action Execution (Module 6) verifies UI page validity before each action to handle transition elements (ads, popups) and includes recovery mechanisms for off-track execution.

Finally, Transformation Validation (Module 7) compares runtime UI behavior against the app's declared purpose using a structured four-phase analysis, producing a determination with confidence and rationale. If positive, a chameleon app has been found. If negative, the loop continues with the next candidate until task completion or timeout.

Demo / Proof of Concept

▶ Watch: Results: 100% precision, 96% recall on known benchmark (10:00)

The system was evaluated on two datasets: a known benchmark (234 chameleon apps + 233 benign apps) and an unknown dataset (1,644 apps collected from live app stores over one month). Against prior work, ChameleoScan outperformed Chameleon Hunter (which cannot handle the 60% of apps using dynamic frameworks) and Mask Catcher (which failed to flag most apps in the dataset). The 150 newly discovered apps and 128 suspicious apps on live app stores demonstrate real-world detection capability.

Defensive Implications

▶ Watch: Cost: $0.10 per app, 2 minutes -- scalable detection (14:00)

ChameleoScan provides app store operators with a practical, scalable tool for detecting chameleon apps that evade current review processes. At $0.10 per app and 2 minutes processing time, it could be integrated into app store review pipelines as an automated post-release monitoring system. The LLM-powered approach is inherently adaptable to new transformation methods, unlike static analysis which requires manual rule updates.

For enterprise mobile security teams, chameleon apps represent a supply chain risk -- employees may install apps that appear to be legitimate productivity tools but contain hidden gambling, piracy, or potentially malicious functionality. Mobile device management (MDM) solutions should incorporate behavioral analysis capabilities similar to ChameleoScan's approach.

Key Takeaways

• Chameleon apps pass app store review but reveal hidden illicit functionality via covert transformation methods distributed outside the app store
• 60% of chameleon apps use dynamic frameworks (Flutter, WebView, React Native) that defeat static analysis
• ChameleoScan achieves 100% precision and ~96% recall using LLM-powered dynamic UI exploration
• 150 new chameleon apps discovered on live app stores during evaluation
• Analysis costs $0.10 per app at ~2 minutes processing time, enabling scalable deployment
• The first taxonomy identifies 10 transformation methods across 4 categories, with input-based methods being the most common

About the Speaker(s)

Hongyu Lin (Ian Hu) is a PhD student at Zhejiang University and co-first author of the paper. The research applies LLM-powered dynamic analysis to the mobile security challenge of detecting apps that disguise their true functionality to evade app store review processes.