A new mobile banking malware, Crocodilus, has been identified on Android devices. It targets crypto wallets through social engineering tactics.
Crocodilus Threat and Features
Crocodilus, discovered by Threat Fabric experts, possesses all key features of modern banking malware. It supports overlay attacks, keylogging, remote access, and hidden remote control. Its uniqueness lies in device takeover and advanced credential theft, using a proprietary dropper to bypass Android 13+ restrictions.
How Crocodilus Works
Once installed, Crocodilus requests the 'Accessibility Service' and connects to a command-and-control server for instructions. It was identified in Spain and Turkey, targeting crypto wallets. Crocodilus bypasses two-factor authentication by using a RAT command to capture screenshots from the Google Authenticator app.
Recommended Security Measures
Crocodilus is unique in coaxing users into providing sensitive information via social engineering. Users are advised to double-check apps before granting Accessibility Service permissions and never share seed phrases. If an app seems odd, it’s better to avoid it. Keeping apps updated can also help defend against such threats.
Crocodilus poses a serious threat to Android users, particularly those dealing with cryptocurrencies. It is crucial to follow security measures and remain vigilant about app activities.
