The Crocodilus malware is spreading globally with new cryptocurrency and banking theft features.

Trojan Crocodilus, first detected in March 2025 in Turkey, is expanding its attack range to Europe, South America, India, Indonesia, and America. This malware masquerades as a casino application, browser, or banking app to steal login information.

In Poland, Crocodilus uses Facebook ads to spread fake applications, bypassing the restrictions of Android 13+. When installed, it displays a fake log in page for banking apps and cryptocurrency wallets, particularly in Spain.

New features include: editing contacts to facilitate phone scams, collecting seed phrases and private keys from cryptocurrency wallets. The malware is more complexly encrypted to avoid analysis.

Smaller campaigns also target cryptocurrency mining applications and European digital banking.

! Crocodilus malware spreads globally with new banking and crypto theft features