Crocodilus malware spreads globally with new capabilities to hijack crypto wallets and banks

PANews reported on June 3rd that, according to Cointelegraph, the Android banking Trojan Crocodilus has recently upgraded and begun attacking cryptocurrency users and bank customers globally. The security company ThreatFabric discovered that the malware has spread from its initial region in Turkey to multiple countries including Poland, Spain, and Argentina. The latest variant can spread malicious programs disguised as browser updates through Facebook ads, using overlay attacks to steal login credentials from banking and crypto applications. The Trojan has added new functions to automatically extract seed phrases and private keys from crypto wallets, and can also modify victims' contact lists by inserting fake "bank support" numbers. Attackers can now rent crypto theft tools for 100-300 USDT per use. Security experts warn users to be cautious of app updates and ad links from unknown sources.