Crocodilus malware targets crypto wallets and bank customers in multiple countries

Planet Daily News: The Android banking Trojan Crocodilus has recently upgraded and begun attacking cryptocurrency users and bank customers globally. The security company ThreatFabric discovered that the malware has spread from its initial region in Turkey to multiple countries including Poland, Spain, and Argentina. The latest variant can spread via Facebook ads disguised as browser updates, using overlay attacks to steal login credentials from banking and crypto applications. The Trojan has added new functions to automatically extract seed phrases and private keys from crypto wallets, and can also modify victims' contact lists by inserting fake "bank support" numbers. Attackers can now rent crypto theft tools for 100-300 USDT per operation. (Cointelegraph)