The Android malware known as ‘Crocodilus‘ is capable of hijacking mobile devices to steal cryptocurrency.
Hackers use the Android malware ‘Crocodilus’ to hijack mobile devices and steal cryptocurrency.
They gain control of the device by deploying a fake overlay and muting audio as soon as a user launches a targeted banking or cryptocurrency app.
Threat Fabric recently identified a new mobile malware family that superimposes fraudulent overlays onto certain apps, fooling Android users into exposing their crypto seed phrases while compromising their devices.
According to Threat Fabric’s March 28 report, Crocodilus presents a fake alert advising users to secure their crypto wallet key before a specified deadline to maintain access.
“Once a victim provides a password from the application, the overlay will display a message: Back up your wallet key in the settings within 12 hours. Otherwise, the app will be reset, and you may lose access to your wallet,” Threat Fabric said.
“This social engineering trick guides the victim to navigate to their seed phrase wallet key, allowing Crocodilus to harvest the text using its accessibility logger.”
Once hackers acquire the seed phrase, they fully compromise the wallet and drain its contents.
Despite being newly identified, Crocodilus integrates all key aspects of modern banking malware. Threat Fabric warns that it includes overlay attacks, screen capture-based data theft, and remote access for full device manipulation.
The infection begins when users unintentionally download the malware as part of other software, allowing it to bypass Android 13’s security.
After installation, Crocodilus requests accessibility service permissions, which hackers exploit to take control.
“Once granted, the malware connects to the command-and-control (C2) server to receive instructions, including the list of target applications and the overlays to be used,” Threat Fabric said.
Running in the background, the malware monitors app launches and triggers fake overlays to intercept sensitive login details.
As soon as users open banking and crypto apps, Crocodilus deploys a fake overlay, cuts off sound, and grants attackers remote access to the device.
“With stolen PII and credentials, threat actors can take full control of a victim’s device using built-in remote access, completing fraudulent transactions without detection,” Threat Fabric said.
Threat Fabric’s analysts found that the malware currently targets users in Turkey and Spain, but they expect it to spread to other regions.
Researchers suspect the developers may be Turkish speakers due to Turkish-language notes in the code. They believe Sybra or another cybercriminal might be behind the malware.
“The emergence of the Crocodilus mobile banking Trojan marks a significant escalation in the sophistication and threat level posed by modern malware.”
“With its advanced Device-Takeover capabilities, remote control features, and the deployment of black overlay attacks from its earliest iterations, Crocodilus demonstrates a level of maturity uncommon in newly discovered threats,” Threat Fabric added.