Researchers from Threat Fabric have discovered a new dangerous Android malware sample called Crocodilus. This trojan is focused on stealing cryptocurrencies, in particular by imitating the interfaces of popular applications and deceiving users. The main goal of the attackers is to gain access to seed phrases — keys to crypto wallets, which allows them to completely withdraw all assets.
The attack mechanism is based on the imposition of a fake window on top of the real application interface. Crocodilus warns the user that they need to back up the key within 12 hours, otherwise the wallet will be reset. This psychological pressure forces the victim to go to the section with the seed phrase, which the fake program records through the accessibility system.
Attackers can take full control of the device by obtaining permission to access Android accessibility services. After that, the program communicates with the control server, receives instructions, a list of target applications, and overlay templates for attacks. Crocodilus can also take screenshots, intercept data input, and launch phishing overlays on banking and cryptocurrency applications.
Cases of the malware’s distribution in Turkey and Spain have been recorded, but experts believe that the geography of its spread will expand. Marks in Turkish were found in the malware code, which suggests that the authors are affiliated with Turkey or are native Turkish speakers.
Threat Fabric experts note the high level of sophistication of this trojan, which from the very first version demonstrates functionality typical of mature malware systems: full device hijacking, remote control, fake overlays, and theft of confidential information. This indicates a new level of threat from mobile malware in the crypto sphere.