New Android Malware ‘Crocodilus’ Silently Hijacks Crypto Wallets Through Fake App Overlays

A stealthy, device-level threat is redefining mobile malware risk for crypto users and beyond

A New Breed of Mobile Malware Emerges

Cybersecurity firm Threat Fabric has uncovered a highly sophisticated strain of Android malware dubbed “Crocodilus”, which specifically targets cryptocurrency and banking apps by deploying black overlay attacks and gaining full remote access to infected devices.

What sets Crocodilus apart is not just its technical capability, but its methodical social engineering tactics that lead users to unknowingly hand over their crypto seed phrases—the digital keys to their wallets.

“The emergence of Crocodilus marks a significant escalation in the sophistication of Android-based malware,” Threat Fabric wrote in its March 28 report.

How It Works: Deception by Design

Crocodilus infiltrates Android phones through malicious apps, often disguised within legitimate-looking third-party APKs that bypass Android 13’s security restrictions. Once installed, it requests accessibility permissions, a common but powerful exploit vector.

Once these permissions are granted, the malware connects to a command-and-control (C2) server to download:

• A list of targeted apps (including crypto wallets and banking apps)

• A set of custom overlays designed to mimic those apps’ login or security prompts

The moment a user opens a targeted crypto app, Crocodilus:

1. Mutes the phone’s sound to avoid detection

2. Launches a black overlay designed to trick users

3. Prompts users to “back up” their wallet key, typically within 12 hours

4. Guides the user through their own seed phrase retrieval process

Using the Android accessibility API, Crocodilus then captures the screen and logs the seed phrase input. With this information, attackers can drain the user’s wallet undetected and in full.

Beyond Basic Theft: Full Device Takeover

What makes Crocodilus uniquely dangerous is its combination of:

• Remote access capability

• Screen capture logging

• Real-time credential interception

• Overlay attacks indistinguishable from the real apps

“Threat actors can take full control of a victim’s device using built-in remote access, completing fraudulent transactions without detection,” Threat Fabric warned.

This positions Crocodilus not just as a crypto wallet stealer, but as a full-spectrum device hijack tool, potentially useful in data exfiltration, financial fraud, surveillance, and identity theft.

Geographic Footprint and Attribution

While the current known targets are users in Turkey and Spain, Threat Fabric’s analysts warn that Crocodilus is likely to expand globally. They speculate that the malware’s developers may be Turkish-speaking, based on notes found within the malware code.

A threat actor known as Sybra may be linked to early testing of the malware, though attribution remains speculative.

“Even in its earliest iterations, Crocodilus displays a level of maturity uncommon in newly discovered malware,” said Threat Fabric’s Mobile Threat Intelligence team.

Why This Matters: The Future of Mobile Malware Has Arrived

Crocodilus represents a turning point for mobile cyber threats. Unlike past malware strains that relied on rudimentary phishing or one-off exploits, this tool is modular, adaptive, and designed for persistent, long-term infiltration.

For the crypto space, this is a direct strike at its most sensitive target: the seed phrase. If compromised, a wallet can be emptied irreversibly—and often, without the victim even realizing what happened until it’s too late.

Moreover, Crocodilus exploits a persistent vulnerability in mobile security: overreliance on accessibility features, which are meant to help users, not expose them.

What Users Can Do: Defense Through Awareness

Crypto investors and mobile banking users should consider the following precautions:

• Avoid sideloading apps or installing APKs from unofficial sources

• Review app permissions, especially accessibility services

• Use hardware wallets and cold storage for significant crypto holdings

• Be skeptical of any app prompting urgent backup actions

• Use mobile security solutions that detect overlay and C2 communication behaviors

Final Thoughts: The Stakes Are Getting Higher

The arrival of Crocodilus highlights how Web3 adoption is increasingly shadowed by Web3-specific threats. As crypto wallets become more integrated into daily mobile usage, they become irresistible targets for malware authors who understand both the value of digital assets and the limitations of mobile operating systems.

Crocodilus is more than malware—it’s a blueprint for the future of device-level attacks, and a wake-up call for users, developers, and cybersecurity providers alike.