New Crocodilus malware steals Android users’ crypto wallet keys

Crocodilus is a newly discovered Android banking/infostealer that uses a proprietary dropper to bypass Android 13 protections and Play Protect, abuses Accessibility Service and screen overlays to trick users into revealing cryptocurrency wallet seed phrases and credentials, and provides RAT capabilities enabling full device takeover; initial operations were observed in Turkey and Spain, and researchers advise avoiding side‑loading APKs and keeping Play Protect enabled.