The Chameleon is Back
The reappearance of the Chameleon device line, in the form of the Chameleon Ultra, brings back a familiar name. For those who remember the frustrations of the Chameleon Mini and Chameleon Tiny, it’s natural to approach this release with skepticism.
The previous models had significant issues, from buggy software to half-finished features. But the Ultra seems to be different. And after evaluation, there’s reason to believe this is the comeback the Chameleon line needed.
The Rise and Fall of the Chameleon Mini and Tiny
The Chameleon Mini and Tiny were early attempts to bring a low-cost, portable RFID emulator to professionals and hobbyists. Originally built by researchers at the Chair for Embedded Security at Ruhr University Bochum, the projects gained traction among the RFID testing community for their promise: cheap emulation of 13.56 MHz cards, with cracking and sniffing functionality.
Unfortunately, the reality didn’t live up to the hype. The Chameleon Mini, while functional in theory, suffered from a clunky, unstable GUI, unreliable support, inconsistent firmware versions, and complex flashing processes.
The Tiny improved on size but introduced its own compatibility problems. By 2022, both were effectively discontinued. Development had stalled, support was minimal, and many testers abandoned the platforms entirely.
Despite their potential, the Mini and Tiny were ultimately too fragmented, buggy, and unsupported to serve as reliable tools for pentesting.
Enter the Chameleon Ultra
The Ultra is built on an ARM Cortex-M0+ microcontroller, offering significantly faster and more reliable performance than the AVR-based predecessors. Its firmware is actively maintained, and unlike previous iterations, the tool is now positioned to be genuinely usable in the field without frustration.
This chart comes from Lab401 comparing various RFID cloning tools. While the chart is subjective, it shows what the creaters of the tool think of it.
What the Chameleon Ultra Can Do
Low & High Frequency Reading / Writing
The Chameleon Ultra hardware supports high and low frequency reading and writing - allowing it to be used as a standalone or connected reader/writer device.
For High Frequency, the device supports ISO14443A chipsets: MIFARE Classic® (1K/2K/4K, 4-byte &, 7-byte UID), NTAG® (210 - 218), Ultralight® (Standard, C, EV1), DESFire® (EV1 & 2) and MIFARE® Plus.
For Low Frequency, the device supports ASK, FSK and PSK modulations - almost 99% of 125KHz chipsets: EM410x, T5577, HID Prox, Indala, FDX-B, Paradox, AWD, PAC/Stanley, etc.
Buttons
The two buttons on teh Ultra can be programed to do various tasks (clone, read, write, etc). This allows you to perform various tasks with a single button press, independent of the App. The benefit of this is the ability to discretely perform various actions like cloning a badge without needing to use your phone at the same time.
Stored Cards
The Ultra has 8 slots that can be used at any time, meaning that while the Ultra can record a large number of cards in its memory, you can emulate up to 8 cards at a time by cycling through the 8 possible card slots via the two buttons.
Reading, Emulation
High Frequency / 13.56MHz
ISO-14443A
Mifare Classic® (1K / 2K / 4K - 4-byte & 7-byte UID)
Ultralight® (Standard, C & EV1)
NTAG® (210 - 218)
Low Frequency / 125KHz
Modulation: AM / PSK / FSK
Supported Cards:
EM4XX / T5577
HID Prox / Indala / PAC/Stanley
FDX-B / Paradox / Keri
Cracking
MIFARE Classic®
MFKey32v2 (Key Calculation from sniffed exchanges)
DarkSide (Key derivation from no known keys)
Nested (Key derivation from one known key)
StaticNested (Key derivation from static PRNG)
HardNested (Key derivation from hardened PRNG)
Low Frequency / 125KHz
T5577 Password Bruteforcing
UID Bruteforcing
The following charts come from Lab401
Why Pentesters Should Care
In a professional context, the Chameleon Ultra hits a sweet spot. It’s fast, it’s portable, and it offers real-world functionality that’s ideal for engagements involving older or vulnerable access control systems. Being able to clone a badge with a single button press is not just convenient—it can be the difference between seizing an opportunity or missing it.
Its size makes it incredibly discreet. It can be hidden in a pocket, clipped to a badge lanyard, or mounted on a keychain. Unlike the Flipper Zero or iCopy-XS, which are bulkier and draw more attention, the Ultra blends in easily. And while it doesn’t have the Swiss army knife versatility of a Flipper, it nails its core function: RFID emulation and cracking for HF cards.
As a backup device, it’s a compelling option. You may rely on a Proxmark3 or iCopy-XS for more advanced work, but the Ultra is a great quick-access tool to carry during recon, badge harvesting, or rapid cloning scenarios. It’s also about the same price as a Flipper Zero but focused entirely on RFID, making it a worthwhile addition to any red teamer's toolkit.
Technical Resources
ChameleonUltra UI Tools (Windows/MacOS/Linux/Android)
Where to Buy the Chameleon Ultra
If you're looking to purchase the Chameleon Ultra, here are your main sources:
United States: Available via Hacker Warehouse, Price is typically around $130 USD.
Europe: Also available from Lab401’s EU storefront, shipping from France or Germany. Price is around €156 EUR.
A note on the App that comes with the ultra, is that it has changed in apperance and name, so if you are struggling to find it on the app store, this is what is currently appears as
The previous app being garbage was really where the chameleon tiny and mini really fell short, but I can personally say that the new app does seem to work as intended … at least at the time of writing this article.
Final Thoughts
The Chameleon Ultra is a genuine evolution of the Chameleon line. It’s stable, capable, and surprisingly effective for the price and form factor. While it’s not the all-in-one tool that a Proxmark3 or Flipper Zero aims to be, it succeeds by doing one thing very well: high-frequency RFID cloning and emulation.
For anyone performing physical security assessments, red team ops, or penetration tests involving badge systems, the Ultra is a smart buy. It deserves a spot in your kit, either as a primary HF tool for lightweight operations or as a backup to your more powerful gear.
The Chameleon is back—and this time, it works.