Crocodilus – A Highly Advanced Android Trojan with Remote Control Capabilities on Banking and Crypto Wallet

The mobile banking Trojan landscape has reached a new level of sophistication with the emergence of Crocodilus, a fully-featured malware family recently uncovered by ThreatFabric. Unlike typical copycat malware, Crocodilus enters the threat landscape as a mature banking Trojan with advanced capabilities like remote device control, black screen overlays, and Accessibility-based data harvesting.

“Crocodilus is not a simple clone, but a fully-fledged threat from the outset, equipped with modern techniques such as remote control, black screen overlays, and advanced data harvesting via accessibility logging.” – ThreatFabric Report

This malware is already targeting banks in Spain and Turkey, as well as cryptocurrency wallets, posing a severe risk to mobile users worldwide.

Technical Analysis of Crocodilus

Crocodilus follows the typical Device Takeover (DTO) banking Trojan playbook but with enhanced stealth and efficiency.

1. Infection Vector: Bypassing Android 13+ Restrictions

Crocodilus spreads via a proprietary dropper designed to circumvent Android’s security restrictions. Once installed, it abuses Accessibility Services—a common but effective tactic seen in other banking Trojans like Anatsa and Octo. ThreatFabric mention that Initial installation is done via a proprietary dropper bypassing Android 13+ restrictions. Once installed, Crocodilus requests Accessibility Service to be enabled.

2. Overlay Attacks & Real-Time Data Theft

The malware employs dynamic overlay attacks, fetching fake login screens from its C2 server based on the app opened by the victim.

• Targets banking & crypto apps (Spain, Turkey observed initially).
• Logs all Accessibility events, effectively functioning as a keylogger and screen capturer.

“Crocodilus monitors all Accessibility events, capturing every element displayed on the screen. This goes beyond simple keylogging—it records all text changes performed by the victim.” – ThreatFabric

3. Remote Access & Black Screen Concealment

One of the most dangerous features is hidden remote control. When activated:

• A black screen overlay masks the attacker’s actions.
• The device is muted to prevent detection.

4. Stealing Google Authenticator Codes

The malware includes a dedicated RAT command (TG32XAZADG) to capture Google Authenticator OTPs by scraping screen content via Accessibility Services and communicate with c2 server.

5. Social Engineering in Crypto Theft

For cryptocurrency wallets, Crocodilus displays a fake warning like below-

This manipulates victims into revealing their seed phrase, which the malware then harvests via Accessibility Logging.

Moreover, Crocodilus support a lots of Bot and RAT commands like

• Launch specified application
• Perform USSD request
• Send SMS to specified number
• Send SMS to all contacts
• Get SMS messages
• Request Device Admin privileges
• Enable/disable remote control session
• Enable/disable self-protection against deletion
• Enable/disable remote control session
• Start front camera image streaming
• Enable/disable “hidden” RAT
• Perform click
• Perform complex gesture
• Write in focused area
• Capture screen content for Google Authenticator app

Who’s Behind Crocodilus

ThreatFabric found references to “sybupdate” in Crocodilus’s code, potentially linking it to “sybra”, a threat actor previously associated with:

• Ermac (MetaDroid fork)
• Hook & Octo malware

However, it remains unclear whether sybra developed Crocodilus or is merely an early adopter. Whether ThreatFabric research team found that first Crocodilus samples contain the tag ‘sybupdate, which could be linked to ‘sybra.

Additionally, Turkish-language debug messages suggest the developers may be Turkish-speaking.

Defensive Recommendations

For Financial Institutions:
🔒 Implement device risk scoring to detect compromised devices.
🔒 Adopt strong customer authentication (SCA) measures beyond SMS OTPs.

Crocodilus represents a significant leap in Android banking Trojan sophistication, combining stealth, remote control, and psychological manipulation to maximize theft. Its capabilities suggest that traditional signature-based detection is insufficient—proactive behavioral analysis and layered security are now essential.

Stay vigilant and secure!