Android Under Attack: Crocodilus Trojan Captures OTPs from Google Authenticator

ThreatFabric’s report describes a newly identified Android banking Trojan called Crocodilus that uses a proprietary dropper to bypass Android 13+ protections, requests Accessibility permissions, deploys overlay attacks and an Accessibility-based logger to capture credentials and seed phrases, can harvest OTPs (including Google Authenticator codes) via screen enumeration, and provides hidden remote control (black-screen overlays, muted audio) to fully take over devices and drain banking and cryptocurrency assets; indicators suggest Turkish-speaking developer(s) and potential ties to the actor ‘sybra’.