The Chameleon Ultra is a portable LF and HF RFID emulator and analyzer designed for security research, red teaming, and advanced access control testing. Built on the NRF52840 platform, it offers 8 independent emulation slots, tag cloning and writing, key-cracking support, and full BLE 5.0 and USB-C connectivity for multi-platform workflows on iOS, Android, macOS, Windows, and Linux.
Perfect for penetration testers, physical security professionals, access control researchers, and RFID hobbyists who need a highly portable device that supports UID changeability, tag emulation, cloning, cracking, and system testing.
📦 Included in This Listing — Exactly What You Receive
This package ONLY includes the following items:
No additional accessories are included.
Key Features
🔹 8 Independent Emulation Slots
Switch between multiple LF (125kHz) and HF (13.56MHz) tag profiles instantly.
🔹 Full Emulation Support
Program the device to behave like a wide variety of smart cards, including many commonly used access badges.
🔹 Tag Cloning / Writing
Read supported LF/HF tags and write the data to compatible blanks — ideal for lab work, testing, or replacing badges.
🔹 Key Cracking Support
Works with MIFARE Classic® and other chipsets using known key-recovery methods.
(Capabilities vary based on current firmware.)
🔹 BLE 5.0 + USB Connectivity
Control the device via MTools BLE or ChameleonUltraGUI, or use direct USB-C communication.
🔹 Multi-Platform Support
Compatible with iOS, Android, macOS, Windows, and Linux.
Card-family compatibility
Checked against upstream development sources on October 21, 2026. These capabilities are not confirmation of the firmware installed on shipped units. Confirm the exact firmware, client and card model before purchase. “Unknown” means not verified in the reviewed sources, not necessarily impossible. The family-specific limits below qualify the general cloning, writing, key-recovery and emulation descriptions on this page.
| Card family |
Read support |
Key recovery |
Writing |
Emulation |
Important restrictions |
| MIFARE Classic Mini / 1K / 2K / 4K |
Block reading supported |
Darkside, nested, static-nested and hardnested workflows present |
Block writing supported |
Named slot types present |
Authentication, card behavior, compatible blanks and host tools affect results. Recovery is not guaranteed. |
| MIFARE Ultralight / EV1 |
Page reading supported |
Unknown |
Page writing supported |
Named slot types present |
Protected or locked pages may limit copying. |
| MIFARE Ultralight C |
Reading and 3DES authentication commands present |
Unknown |
Writing and key-change commands present |
Named slot type present |
Known-key authentication is not proof of unknown-key recovery. |
| NTAG213 / 215 / 216 |
Page reading supported |
Unknown |
Page writing supported |
Named slot types present |
Passwords and page protection affect access. Emulation does not guarantee acceptance by every reader. |
| HID Prox, LF |
Scan/read commands present |
Unknown; no recovery claim |
Supported-format data written to T55xx blanks |
HID Prox slot and configuration commands present |
HID Prox support does not establish HID iCLASS support. |
| EM410x, LF |
ID scanning supported |
Not applicable to documented ID-copy workflow |
ID written to T55xx blanks |
Named slot types present |
Writing a compatible blank is distinct from rewriting the original tag. |
| HID iCLASS / SE / DL |
Unknown |
Unknown |
Unknown |
Unknown |
No verified cloning claim for these families. Do not purchase specifically for iCLASS DL cloning without exact-card verification. |
| MIFARE DESFire EV1 / EV2 / EV3 |
Information commands present; protected-data reading unknown |
Candidate-key checking present; unknown-key recovery not verified |
Unknown |
Full DESFire emulation unknown |
Information retrieval, key checking and generic protocol support do not establish credential cloning. |
| ISO 15693 |
Unknown |
Unknown |
Unknown |
Unknown |
No compatibility promise based on the reviewed sources. |
Verification sources: Official command and slot definitions and official CLI implementation. Development-branch capabilities may differ from released or installed firmware. Use only on cards and systems you own or have explicit authorization to test.
Technical Specifications
Chipset: NRF52840
Memory: 256KB RAM / 1MB Flash
Frequencies: 125kHz LF & 13.56MHz HF
Connectivity: Bluetooth BLE 5.0, USB-C
Battery: Rechargeable LiPo (up to ~6 months standby)
Controls: 2× programmable hardware buttons
Visual Indicators: RGB LED system for slot and mode status
What You Can Do With It
Emulate
Simulate various LF/HF tag types for system testing and reader validation.
Clone
Copy supported tag data to blanks or internal emulation slots.
Analyze & Test
Assess reader performance, validate access systems, and identify configuration weaknesses.
Experiment & Develop
Modify or rebuild the open-source firmware to create custom workflows and tools.
Software Compatibility
MTools BLE (iOS/Android)
ChameleonUltraGUI (Windows/macOS/Linux)
Official ChameleonUltra CLI
Full open-source firmware from the RRG team
Important Notes
Some chipsets and features (e.g., T5557, certain cracking flows) may still be in development.
Ensure legal compliance and proper authorization before testing or copying any credentialed media.
Intended for security research, auditing, and lawful testing only.
Why Buy From STS Collective
🇺🇸 Fast domestic U.S. shipping
✔️ Curated tools for red teams, RF researchers, and access control professionals
✔️ Direct support from an experienced operator—not a dropship reseller
✔️ Secure, protective packaging with tracking
Setup guides and downloads
Download your free PDF guide for setup, power requirements, troubleshooting and documentation links. Save a copy for offline reference.
Project documentation
Use the instructions for your exact hardware and installed firmware version. Setup help: support@stscollective.com.
Original project, developer, and DIY resources
These links identify the upstream project, its documentation, and available self-installation or reprogramming information. STS Collective provides prepared hardware for customers who prefer not to assemble or flash a device themselves.
Hardware, firmware, compatibility, testing, and support
-
Hardware: Chameleon Ultra LF + HF RFID Emulator & Analyzer
-
Firmware: Chameleon Ultra is the firmware or software path identified above. The listing states that the image is installed or preloaded.
-
Compatibility: Supports only the frequencies, cards, readers, host connections, and software identified above.
-
Testing: This listing does not promise individual pre-shipment testing. Contact support before ordering if you need a specific verification.
-
Setup and DIY: Use the project, setup, and DIY references already included in this description. Follow the guide for the exact hardware and firmware. Project or setup documentation 1 Project or setup documentation 2 Project or setup documentation 3
-
Support: Contact support@stscollective.com for setup and product questions.
-
Lawful use: Use only on hardware, networks, cards, radio bands, and systems you own or have explicit permission to test. Follow applicable laws, platform rules, privacy rules, and radio regulations. Do not access, copy, interfere with, or disrupt other people's systems.
