Android malware Crocodilus adds fake contacts to spoof trusted callers

The report details the evolution of the Crocodilus Android malware: researchers observed global expansion and multiple evasion/sophistication improvements (dropper packing, additional XOR payload encryption, code convolution, and local parsing of stolen data). A notable new TTP programmatically adds fake local contacts on infected devices to enable believable social-engineering calls (e.g., posing as bank support), increasing the malware's effectiveness in stealing credentials and controlling devices; users are advised to download apps only from trusted sources and keep protections like Play Protect enabled.