Crocodilus – Earlybirds Invest

The Mobile Threat Intelligence team at ThreatFabric has reported that the Android malware, Crocodilus, is targeting banking and cryptocurrency users in several regions, including Europe, South America, Asia, and the United States.

In Poland, a recent campaign used Facebook ads to promote a fake rewards app. When users clicked the ad, they were redirected to a malicious website that installed malware. This version of Crocodilus could bypass the protections in Android 13 and later versions.

Meanwhile, in Spain, the malware pretended to be a browser update and went after customers of nearly all major banks. Once installed, it overlays fake login pages onto real banking and crypto apps.

Proof of Work vs Proof of Stake: Which is Better? (ANIMATED)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe – We publish new crypto explainer videos every week!

Recent updates to Crocodilus include new tools for stealing more than just login details.

One feature enables the malware to add fake phone numbers to a device’s contact list, which labels them as “Bank Support”. Another new tool focuses on cryptocurrency wallets. Crocodilus includes a feature that can automatically collect recovery phrases and private keys.

<br />

Furthermore, the developers behind Crocodilus have added new layers of code protection. The malware employs multiple forms of encryption and complex programming techniques, which hinder efforts to understand its operation and mitigate its effects.

Originally found in Turkey in March 2025, Crocodilus disguised itself as fake gambling and banking apps to steal login information.

On May 22, cybersecurity firm Moonlock reported that hackers are targeting macOS users with fake Ledger Live apps. How do these fake apps work? Read the full story.

Crocodilus Displays Overlays to Target Banks and Cryptos

Crocodilus malware works on a modus operandi similar to modern “Device Takeover banking Trojan,” analysts noted. After initial installation via a proprietary dropper, the malware requests “Accessibility Service” to be enabled, they added.

In order to intercept credentials, Crocodilus connects to the command-and-control (C2) server for instructions such as overlays to be used.

Further, the threat initially appeared in Spain and Turkey, targeting several crypto wallets, the Mobile Threat Intelligence team revealed.

“We expect this scope to broaden globally as the malware evolves,” the team noted.

Additionally, the two-factor authentication (2FA) is bypassed by the malware using RAT command that triggers a screen capture on the content of the Google Authenticator application. Crocodilus captures the code displayed on the screen in the Google Authenticator app, and sends to the C2.

Malware Instructs Victims to Do the Job

Unlike other Trojans, Crocodilus overlays target crypto wallet by asking victims to take a backup of their wallet keys.

“Back up your wallet key in the settings within 12 hours. Otherwise, the app will be reset, and you may lose access to your wallet,” the overlay text reads.

This social engineering hack guides victims to navigate to their seed phrase. This inturn allows Crocodilus to extract the text using its Accessibility Logger.

“With this information, attackers can seize full control of the wallet and drain it completely,” Threat Fabric analysts said.

The post New ‘Crocodilus’ Android Malware Steals Sensitive Crypto Wallet Credentials: Research appeared first on Cryptonews.