Android malware ‘Crocodilus’ can take over phones to steal crypto
Cybersecurity firm Threat Fabric says it has found a new family of mobile-device malware that can launch a fake overlay for certain apps to trick Android users into providing their crypto seed phrases as it takes over the device.
Threat Fabric analysts said in a March 28 report that the Crocodilus malware uses a screen overlay warning users to back up their crypto wallet key by a specific deadline or risk losing access.
“Once a victim provides a password from the application, the overlay will display a message: Back up your wallet key in the settings within 12 hours. Otherwise, the app will be reset, and you may lose access to your wallet,” Threat Fabric said.
“This social engineering trick guides the victim to navigate to their seed phrase wallet key, allowing Crocodilus to harvest the text using its accessibility logger.”

Once the threat actors have the seed phrase, they can seize complete control of the wallet and “drain it completely.”
Threat Fabric says despite it being a new malware, Crocodilus has all the features of modern banking malware, with overlay attacks, advanced data harvesting through screen capture of sensitive information such as passwords and remote access to take control of the infected device.
Initial infection occurs by inadvertently downloading the malware in other software that bypasses Android 13 and security protections, according to Threat Fabric.
Once installed, Crocodilus requests accessibility service to be enabled, which enables the hackers to gain access to the device.
“Once granted, the malware connects to the command-and-control (C2) server to receive instructions, including the list of target applications and the overlays to be used,” Threat Fabric said.

It runs continuously, monitoring app launches and displaying overlays to intercept credentials. When a targeted banking or cryptocurrency app is opened, the fake overlay launches over the top and mutes the sound while the hackers take control of the device.
“With stolen PII and credentials, threat actors can take full control of a victim’s device using built-in remote access, completing fraudulent transactions without detection,” Threat Fabric said.
Threat Fabrix’s Mobile Threat Intelligence team has found the malware targets users in Turkey and Spain but said the scope of use will likely broaden over time.
They also speculated that the developers could speak Turkish, based on the notes in the code, and added that a threat actor known as Sybra or another hacker testing out new software could be behind the malware.
“The emergence of the Crocodilus mobile banking Trojan marks a significant escalation in the sophistication and threat level posed by modern malware.”
“With its advanced Device-Takeover capabilities, remote control features, and the deployment of black overlay attacks from its earliest iterations, Crocodilus demonstrates a level of maturity uncommon in newly discovered threats,” Threat Fabric added.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
Sam Altman’s Worldcoin has started using eye-scanning kiosks in several UK cities
Sony’s Layer-2 Blockchain Soneium Unveils Gaming Incubator
XRP Recovers, Cardano Faces Resistance, and BlockDAG’s X1 Miner App Hits 1.5M Users As Early Adoption Skyrockets
XRP sees steady recovery and Cardano stays under pressure, but BlockDAG’s 1.5M active miners may signal a high-growth crypto in the making. Discover why BDAG could become a top 10 crypto by 2025.BlockDAG’s X1 Miner Surpasses 1.5 Million Users as Adoption Surges Pre-LaunchCardano (ADA) Bearish Pattern May Mask Underlying Setup for RecoveryFinal Analysis

BlockDAG’s $0.0018 Price Shakeup: Is This the Best Crypto to Buy in 2025 Before Time Runs Out?
BlockDAG slashes presale price to $0.0018, its lowest since Batch 1. With $290M already raised and a $0.05 launch target, the top crypto to buy in 2025 might just be this one. Offer ends June 13.Back to the Start: Lowest Pricing Since Batch 1 and Possibly the Final TimeWhy $0.05 Is Just the Start: The ROI Case That’s Capturing AttentionScarcity Heats Up as June 13 Deadline NearsFinal Thoughts: A Second Chance That Rarely Comes in Crypto

Trending news
MoreCrypto prices
More








