The Crocodilus banking trojan is expanding globally with new campaigns targeting crypto wallets and banking apps, now reaching Europe and South America.
Android banking trojan Crocodilus has launched new campaigns targeting crypto users and banking customers across Europe and South America.
First detected in March 2025, early Crocodilus samples were largely limited to Turkey, where the malware posed as online casino apps or spoofed bank apps to steal login credentials.
Recent campaigns show it now hitting targets in Poland, Spain, Argentina, Brazil, Indonesia, India and the US, according to findings from ThreatFabric’s Mobile Threat Intelligence (MTI) team.
