Biometric authentication vulnerabilities arise from the use of biometric authentication without encryption, allowing attackers to manipulate the application during runtime to bypass the authentication process.

### Real-world Cases:

- **Chameleon**: a mobile malware with a wide arsenal of capabilities, notably its ability to bypass biometric authentication making it easy to steal personal data such as PINs, passwords, or graphical keys
- **SharkBot**: an Android banking trojan that can take over a user’s device and cancel the biometric verification pop-up when they attempt to log in to their mobile banking app.

### Business Impact:

- **Data Breaches**: If biometric authentication is bypassed, it can lead to unauthorized access to sensitive information stored on mobile devices, such as personal data, financial information, and business-related data.
- **Identity Theft**: Bypassing biometric authentication can facilitate identity theft, as malicious actors may gain unauthorized access to personal and business accounts.
- **Fraudulent Activities**: Unauthorized access to mobile devices can result in fraudulent transactions, leading to financial losses for both individuals and businesses.
