Mars Finance News, researchers from the security company ThreatFabric stated that the new malware Crocodilus can steal Android users' wallet seed phrases. The malware spreads through a proprietary driver and bypasses security protections of Android 13 (and higher versions), not triggering Play Protect when users install the malware. The malware uses screen overlay to falsely warn users to "backup wallet seed phrases in settings within 12 hours", otherwise they may lose access to their wallet.