Crocodilus Android Trojan Adds Crypto Wallet Heist Tools in Global Expansion

Android banking trojan Crocodilus has launched new campaigns targeting crypto users and banking customers across Europe and South America.
First detected in March 2025, early Crocodilus samples were largely limited to Turkey, where the malware posed as online casino apps or spoofed bank apps to steal login credentials.
Recent campaigns show it now hitting targets in Poland, Spain, Argentina, Brazil, Indonesia, India and the US, according to findings from ThreatFabric’s Mobile Threat Intelligence (MTI) team.
A campaign targeting Polish users tapped Facebook Ads to promote fake loyalty apps. Clicking the ad redirected users to malicious sites, delivering a Crocodilus dropper, which bypasses Android 13+ restrictions.
Facebook transparency data revealed that these ads reached thousands of users in just one to two hours, with a focus on audiences over 35.
Related: Microsoft takes legal action against infostealer Lumma
Crocodilus targets banking and crypto apps
Once installed, Crocodilus overlays fake login pages on top of legitimate banking and crypto apps. It masqueraded as a browser update in Spain, targeting nearly all major banks.
Beyond geographic expansion, Crocodilus has added new capabilities. One notable upgrade is the ability to modify infected devices’ contact lists, enabling attackers to insert phone numbers labeled as “Bank Support,” which could be used for social engineering attacks.
Another key enhancement is an automated seed phrase collector aimed at cryptocurrency wallets. The Crocodilus malware can now extract seed phrases and private keys with greater precision, feeding attackers pre-processed data for fast account takeovers.
Meanwhile, developers have strengthened Crocodilus’ defenses through deeper obfuscation. The latest variant features packed code, additional XOR encryption and intentionally convoluted logic to resist reverse engineering.
MTI analysts also observed smaller campaigns targeting cryptocurrency mining apps and European digital banks.
“Just like its predecessor, the new variant of Crocodilus pays a lot of attention to cryptocurrency wallet apps,” the report said. “This variant was equipped with an additional parser, helping to extract seed phrases and private keys of specific wallets.”
Related: COLDRIVER using new malware to steal from Western targets — Google
Crypto drainers sold as malware
In an April 22 report, crypto forensics and compliance firm AMLBot revealed that crypto drainers, malware designed to steal cryptocurrency, have become easier to access as the ecosystem evolves into a software-as-a-service business model.
The report revealed that malware spreaders can rent a drainer for as little as 100-300 USDt (USDT).
On May 19, it was revealed that Chinese printer manufacturer Procolored had distributed Bitcoin-stealing malware alongside its official drivers.
Magazine: Move to Portugal to become a crypto digital nomad — Everybody else is
Bitcoin (BTC) $ 123,477.00
Ethereum (ETH) $ 4,746.69
XRP (XRP) $ 3.32
Tether (USDT) $ 1.00
BNB (BNB) $ 849.10
Solana (SOL) $ 203.03
USDC (USDC) $ 0.999789
Lido Staked Ether (STETH) $ 4,726.58
Dogecoin (DOGE) $ 0.248449
Cardano (ADA) $ 0.957989
TRON (TRX) $ 0.363025
Wrapped stETH (WSTETH) $ 5,747.29
Chainlink (LINK) $ 23.94
Hyperliquid (HYPE) $ 47.35
Wrapped Bitcoin (WBTC) $ 123,227.00
Wrapped Beacon ETH (WBETH) $ 5,094.87
Stellar (XLM) $ 0.462287
Sui (SUI) $ 4.07
Wrapped eETH (WEETH) $ 5,078.59
Bitcoin Cash (BCH) $ 620.32
Hedera (HBAR) $ 0.271361
WETH (WETH) $ 4,741.11
Ethena USDe (USDE) $ 1.00
Avalanche (AVAX) $ 25.60
Litecoin (LTC) $ 133.14
Toncoin (TON) $ 3.55
LEO Token (LEO) $ 9.25
Shiba Inu (SHIB) $ 0.000014
USDS (USDS) $ 0.999710
Uniswap (UNI) $ 12.11
Coinbase Wrapped BTC (CBBTC) $ 123,432.00
Binance Bridged USDT (BNB Smart Chain) (BSC-USD) $ 1.00
WhiteBIT Coin (WBT) $ 47.00
Polkadot (DOT) $ 4.31
OKB (OKB) $ 105.13
Bitget Token (BGB) $ 4.84
Ethena Staked USDe (SUSDE) $ 1.19
Cronos (CRO) $ 0.167729
Pepe (PEPE) $ 0.000012
Ethena (ENA) $ 0.779372
Aave (AAVE) $ 331.67
Monero (XMR) $ 251.30
Dai (DAI) $ 0.999788
Bittensor (TAO) $ 395.68
Mantle (MNT) $ 1.12
NEAR Protocol (NEAR) $ 3.01
Ethereum Classic (ETC) $ 24.20
Aptos (APT) $ 5.09
Ondo (ONDO) $ 1.08
Internet Computer (ICP) $ 6.03
Pi Network (PI) $ 0.400935
Jito Staked SOL (JITOSOL) $ 248.28
Binance-Peg WETH (WETH) $ 4,737.06
Arbitrum (ARB) $ 0.555492
Kaspa (KAS) $ 0.099528
Algorand (ALGO) $ 0.283808
BlackRock USD Institutional Digital Liquidity Fund (BUIDL) $ 1.00
Pudgy Penguins (PENGU) $ 0.037504
POL (ex-MATIC) (POL) $ 0.258621
VeChain (VET) $ 0.026596
Cosmos Hub (ATOM) $ 4.88
Rocket Pool ETH (RETH) $ 5,390.15
USD1 (USD1) $ 1.00
Render (RENDER) $ 4.14
Gate (GT) $ 17.66
Bonk (BONK) $ 0.000027
Worldcoin (WLD) $ 1.12
Binance Staked SOL (BNSOL) $ 216.76
Kelp DAO Restaked ETH (RSETH) $ 4,983.12
Sei (SEI) $ 0.359019
sUSDS (SUSDS) $ 1.06
Fasttoken (FTN) $ 4.58
Official Trump (TRUMP) $ 9.93
Artificial Superintelligence Alliance (FET) $ 0.754832
Jupiter Perpetuals Liquidity Provider Token (JLP) $ 5.44
Filecoin (FIL) $ 2.74
StakeWise Staked ETH (OSETH) $ 4,997.63
Story (IP) $ 5.90
Sky (SKY) $ 0.082105
Liquid Staked ETH (LSETH) $ 5,146.34
Jupiter (JUP) $ 0.558010
Flare (FLR) $ 0.023568
KuCoin (KCS) $ 13.28
Lombard Staked BTC (LBTC) $ 123,336.00
Mantle Staked Ether (METH) $ 5,042.12
SPX6900 (SPX) $ 1.75
Injective (INJ) $ 16.16
Celestia (TIA) $ 2.00
Optimism (OP) $ 0.852400
USDtb (USDTB) $ 0.999502
XDC Network (XDC) $ 0.089426
Stacks (STX) $ 0.801553
Curve DAO (CRV) $ 1.04
Renzo Restaked ETH (EZETH) $ 5,004.36
Pump.fun (PUMP) $ 0.003966
NEXO (NEXO) $ 1.36
USDT0 (USDT0) $ 1.00
Lido DAO (LDO) $ 1.50
Falcon USD (USDF) $ 0.999986
Provenance Blockchain (HASH) $ 0.027549