Crocodilus
Crocodilus is an Android banking trojan discovered by ThreatFabric. It is described as a highly capable mobile banking malware family that follows a modern device-takeover model and uses overlay attacks, accessibility-based logging/keylogging, remote access, and hidden remote-control features to steal banking and cryptocurrency-related data. The malware is initially installed via a proprietary dropper that can bypass Android 13+ restrictions, after which it abuses Android Accessibility Services and connects to a command-and-control server to receive target application lists, overlay configurations, and commands.
Observed capabilities include monitoring app launches, displaying credential-harvesting overlays over targeted applications, collecting SMS messages, sending SMS messages to specified numbers, lists of numbers, or all contacts, performing USSD requests, manipulating the victim’s contact list by adding contacts to support social-engineering attacks, and capturing screen content and visible UI elements through accessibility logging. ThreatFabric reported that Crocodilus can capture OTP data from Google Authenticator, including labels and values, and exfiltrate them to its C2. It can also hide attacker activity by displaying a black screen overlay and muting the device during fraudulent operations. The malware has been reported as capable of taking full control of infected phones to steal funds from banking and online accounts.
Crocodilus also targets cryptocurrency wallets. Reported tradecraft includes a social-engineering overlay that urges victims to back up their wallet key within 12 hours, guiding them to reveal seed phrases that are then harvested via accessibility logging. With stolen seed phrases, attackers can seize and drain wallets.
Distribution vectors mentioned in the content include malvertising campaigns, fake banking apps, fake browser updates, malicious ads, and phony applications. Early campaigns targeted banks in Spain and Turkey, and later reporting states the malware expanded globally, including activity in Poland, South America, parts of Asia, and broader worldwide targeting. ThreatFabric noted possible links to the mobile threat actor "sybra" based on early samples tagged "sybupdate," but stated this may indicate either a development link or a customer testing the malware. Source-code debug messages reportedly suggest Turkish-speaking developer(s).
High-confidence indicators mentioned in the content include SHA-256 c5e3edafdfda1ca0f0554802bbe32a8b09e8cc48161ed275b8fec6d74208171f and command-and-control domain register-buzzy[.]store.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This environment has paved the way for the emergence of Crocodilus, a new and highly capable mobile banking Trojan discovered by ThreatFabric.
Techniques & procedures
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
1 technique
Execution
Persistence
1 technique
Persistence
Once installed, Crocodilus requests Accessibility Service to be enabled. Once granted, the malware connects to the command-and-control (C2) server to receive instructions... Another data theft feature of Crocodilus is a keylogger. However, it is more accurate to call it an Accessibility Logger – the malware monitors all Accessibility events and captures all the elements displayed on the screen.
Privilege Escalation
1 technique
Privilege Escalation
Once installed, Crocodilus requests Accessibility Service to be enabled. Once granted, the malware connects to the command-and-control (C2) server to receive instructions... Another data theft feature of Crocodilus is a keylogger. However, it is more accurate to call it an Accessibility Logger – the malware monitors all Accessibility events and captures all the elements displayed on the screen.
Stealth
2 techniques
Stealth
Credential Access
2 techniques
Credential Access
Collection
3 techniques
Collection
It runs continuously, monitoring app launches and displaying overlays to intercept credentials.
Recent activity
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android malware that manipulates victims' contact lists to help attackers impersonate trusted entities such as banks.
Referenced as an Android banking malware family that similarly abuses Android Accessibility services for banking fraud/credential theft techniques.
Android banking malware abusing Accessibility services for credential theft and data harvesting; includes remote control and overlay/black-screen techniques; targets Spain and Turkey.
Android banking trojan active across multiple countries; targets banks and cryptocurrency wallets; includes obfuscation and contact manipulation capabilities.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.