Crocodilus: A Sophisticated Threat Evolution in Android Banking Trojans

Security researchers have uncovered a new mobile banking Trojan, dubbed Crocodilus, marking a significant leap in Android-targeted malware sophistication.

Unlike earlier threats such as Anatsa, Octo, and Hook, which evolved gradually, Crocodilus emerges as a fully developed cyber threat. It integrates advanced attack techniques, including overlay attacks, accessibility-based data harvesting, remote access trojan (RAT) capabilities, and obfuscated remote control mechanisms.

Discovery and Origins

Crocodilus was detected during routine threat-hunting operations, with its name derived from developer artifacts referencing “Crocodile” within its codebase.

Technical Analysis

Crocodilus employs a multi-stage infection chain, beginning with a proprietary dropper engineered to bypass Android 13+ runtime permission restrictions (such as sideload detection). After installation, the malware requests Accessibility Services permissions, a pivotal step that enables its full functionality.

Once granted access, Crocodilus establishes a persistent connection to its command-and-control (C2) server, retrieving real-time attack configurations, including target application package names and phishing overlay templates.

The Trojan functions as a device-takeover malware, monitoring active applications and launching HTML-based overlays over legitimate banking and cryptocurrency apps to harvest user credentials. Initial attack campaigns have targeted financial institutions in Spain and Turkey, as well as popular cryptocurrency wallets, with expectations of broader expansion as its C2 infrastructure scales.

Advanced Capabilities

A key distinguishing feature of Crocodilus is its “Accessibility Logger,” which surpasses traditional keylogging techniques. By hooking into Android’s Accessibility API, it logs all UI elements and events, including:

• Text inputs
• Button labels
• Dynamic content (such as OTP codes from Google Authenticator)

For instance, executing the RAT command “TG32XAZADG” triggers a targeted screen capture of Google Authenticator, extracting OTP names and values for immediate exfiltration.

The malware’s RAT module grants full remote control, including:

• Stealth mode activation – deploying a black screen overlay to conceal attacker actions
• Device audio suppression – muting sounds to prevent victims from detecting unauthorized operations

These capabilities allow attackers to conduct fraudulent transactions unnoticed.

Attribution and Potential Links

Early samples of Crocodilus contain the tag “sybupdate,” potentially linking it to the “sybra” threat actor, previously associated with the Ermac fork “MetaDroid” and campaigns involving Hook and Octo. However, attribution remains inconclusive—”sybra” could be a developer, distributor, or early adopter. Debug strings found in the malware’s code, written in Turkish, suggest the involvement of Turkish-speaking developers.

Social Engineering and Data Theft

Crocodilus employs deceptive tactics to compromise cryptocurrency wallets. After harvesting credentials via overlays, it displays a fraudulent prompt:

“Back up your wallet key in the settings within 12 hours. Otherwise, the app will be reset, and you may lose access to your wallet.”

This manipulative message tricks victims into revealing their seed phrases, which the Accessibility Logger captures, granting attackers full access to their crypto funds.

The Threat Landscape and Defense Strategies

Crocodilus represents a new frontier in mobile malware. Its combination of device takeover, black-screen obfuscation, and advanced logging techniques elevates its threat level beyond traditional banking Trojans.

Targeting high-value assets such as banking credentials and cryptocurrency keys, it exploits Android’s Accessibility Services in ways that bypass conventional security measures.

Defensive Measures:

• Behavioral analysis of app interactions
• Runtime device integrity checks
• Anomaly detection in network traffic to C2 servers

Given the polymorphic nature of Crocodilus, signature-based detection alone is insufficient. Financial institutions and cryptocurrency platforms must adopt a multi-layered security strategy to mitigate this rapidly evolving threat.