Crocodilus Mobile Malware: Evolving Fast, Going Global

[Oshosondy]

We have discussed about this malware before on this forum. It was limited to Turkey before but the malware is seen spreading fast to other countries. It is now seen in some countries in Europe and South America now.

The recent one as an example was seen on Facebook as an ad. These ads encouraged users to download an app to claim bonus points. If downloaded, it can steal seed phrase and bank account access details.

It was also reported that the app is getting modified.

According to Facebook’s ad transparency data, these advertisements were live for just 1–2 hours, but each was shown more than a thousand times. The majority of viewers were over 35, indicating a focus on a solvent audience.

Upon clicking the "Download" button, users were redirected to a malicious site that delivered the Crocodilus dropper, capable of bypassing Android 13+ restrictions.

People need to read more about this malware.


https://www.threatfabric.com/blogs/crocodilus-mobile-malware-evolving-fast-going-global

[Mia Chloe]

Upon clicking the "Download" button, users were redirected to a malicious site that delivered the Crocodilus dropper, capable of bypassing Android 13+ restrictions.

Most recent versions of android are trying to be more secured concerning malwares like this. However the honest truth is that it still falls back to the user of that particular device. For a malware to prove effective on a device permissions has to be granted and where this is a downside on this kind of malwares is that they can most times bypass those permissions. Sometimes the user carelessly grant these permissions without reading and they can split most of the time to batch files so an uninstall isn't effective sometimes.

[Oshosondy]

Most recent versions of android are trying to be more secured concerning malwares like this. However the honest truth is that it still falls back to the user of that particular device. For a malware to prove effective on a device permissions has to be granted and where this is a downside on this kind of malwares is that they can most times bypass those permissions. Sometimes the user carelessly grant these permissions without reading and they can split most of the time to batch files so an uninstall isn't effective sometimes.

The installation will be a simple process when the victim download the app, he will easily grant the app access to do its work thinking he has not done anything bad than giving the app he has just downloaded permission and which can lead to lost of money or lead to lose of information.

[Hazink]

The installation will be a simple process when the victim download the app, he will easily grant the app access to do its work thinking he has not done anything bad than giving the app he has just downloaded permission and which can lead to lost of money or lead to lose of information.

This is just like when a user installs a certain app on their Android devices; upon completion of the installation, the app (most) will want to automatically open itself, and when it's halfway from opening, permission to have access to the device, something like allowing the app to track activities, location, and display location, someone who is not security cautious will easily permit the app to do all those things even without reading to know what they are granting a third party access to do on their gadget.

[justinlamode]

If this virus spread through clicking and installing applications, then a lot of people will escape it for such but it is still a big threat that should not be written off because one cannot be careful enough. Obviously, a lot is yet to be known about this new virus but then I will be mindful of any add I see on social media since that is the new ways scammers are using to target their victims.

[Obim34]

It's really stupid to download any resource from social media, some mistakes are needed to become the victim without pity. As an investor aside from that, with the current modern advancement, everyone should be current with security dominance. Scammers are not going to take it lightly when trying to defraud their victims, if anyone fails to dodge the threat, then they become the victim. Telegram and Facebook are the environment for scammers, some people still go ahead and download files from Telegram, that's carelessness not ignorance.

If this virus spread through clicking and installing applications, then a lot of people will escape it for such but it is still a big threat that should not be written off because one cannot be careful enough. Obviously, a lot is yet to be known about this new virus but then I will be mindful of any add I see on social media since that is the new ways scammers are using to target their victims.

It is not about the multitude is for those who would fall victim, few people falling victim means they get stolen from. Social media is not a good place to loosen our privacy consciousness, slightest mistakes can cause us great harm.

[Amphenomenon]

As things are going while the social media would be finding ways of avoiding or limiting  malicious ads and attackers being innovative, i think the best option might to avoid clicking these links there in the first place, don't see ads there as secure, rather try to visit official sites and also check for possible malicious threats.

If this virus spread through clicking and installing applications, then a lot of people will escape it for such but it is still a big threat that should not be written off because one cannot be careful enough. Obviously, a lot is yet to be known about this new virus but then I will be mindful of any add I see on social media since that is the new ways scammers are using to target their victims.

It is not about the multitude is for those who would fall victim, few people falling victim means they get stolen from. Social media is not a good place to loosen our privacy consciousness, slightest mistakes can cause us great harm.

If this wasn't identified earlier it could have gotten to thousands, there are much traffic from social media and that's why attackers continues to target them and Google ads. Through this they can get thousands of victims falling for their schemes. With about a billion+ using Facebook daily it's not an exaggeration to say thousands or more may click this with in a short period of like a week or days.

[Porfirii]

It's really stupid to download any resource from social media, some mistakes are needed to become the victim without pity. -snip-

Moral: you shouldn't use facebook in the first place well, I'm just kidding (not really).

If it hasn't changed, I think that social media are still not responsible for the ads they show. It's a good thing that they were able to detect it in only 1-2 hours, but it is still a very long time looking at the exposure and impact it had.

People usually rely on what they see in "official" sites, as they don't usually know that some of that content is embedded from a different source. In cases like this one, it leads to a lesson that can be too expensive to learn.

[Alphakilo]

There are two things I picked from this post, first, that Facebook and other social media who allow these malicious ads on their website without doing their due diligence are also complicit in whatever harm that the ads further does to people who click on them.

Second that these malware even though they will at first be restricted to one region are going to spread without notice to others. And even though they will initially be restricted to one type of device - windows are going to spread to other device type -macbook. They are always modified.

Stay safe and be very careful of your internet use.

[katanic97]

It's really stupid to download any resource from social media, some mistakes are needed to become the victim without pity. As an investor aside from that, with the current modern advancement, everyone should be current with security dominance. Scammers are not going to take it lightly when trying to defraud their victims, if anyone fails to dodge the threat, then they become the victim. Telegram and Facebook are the environment for scammers, some people still go ahead and download files from Telegram, that's carelessness not ignorance.

-snip-

Lately, i’ve been seeing more and more older people (50+) using Facebook. Every day i come across sponsored ads and fake profiles promoting bogus products aimed at older users, trying to lure them into buying something by asking them to send money in advance or provide their bank card number and password. Unfortunately, this is happening, and the problem is that this malware is spreading rapidly. People need to be cautious. It's easy for us to recognize a potential scam, but others may not be as aware. I really hope this kind of thing happens less and less.

[coinlary]

Current versions of browser do prevent auto download from their settings  and also, installed unknown apps are usually turned off on most of modern mobile devices. I don't  know if  the malware can bypass these but it's also a good practice to always leave these settings positive, we never  can tell which might work.
From the article aswell, it's showing it that they've upgraded it to targeting more crypto users using those regex ..
I couldn't  see the blurred part very well but I'm sure  I saw something  like  'app.phantom' on the cryptoTarget2 which means phantoms users are part of their target. There are lots of people using phantom wallet though.

Somehow similar to the Android/data/*   directory although Android introducesd restricted access to those  directory  in  Android  11 and recent , it should be easy for the malware to bypass  just as users can also bypass using third party apps.
The best solution to have a separate device to surf Internet  which won't hold so much of sensitive datas when attacked.

[lovesmayfamilis]

That is why I have completely stopped interacting with any social networks, and if I have remained in some, I am always in reading mode, not interacting. It is time for all lovers of freebies to accept the fact that there is no free money on the Internet. Any promotion that tempts the user with some bonuses or prizes ultimately entails either marketing or fraud. Those who succumb to the tricks of scammers, wanting to get a few bucks, end up with empty wallets. But people themselves condone the continuation of fraud since they do not monitor sites about scams but look for profit on the Internet. I think this activity suits everyone, both scammers and their victims.

[KiaKia]

It's highly time that people need to keep everything crypto wallet related off away from phones and computer, I have been creaming about this for a long time now and it seems many people still don't want to hear someone telling them why a hardware wallet is better.

Getting a hardware wallet that's open source and controlable on its own will safe you from all these online attacks, download what you like on your phones and computer, infected or not it's none of your concerns.

Hardware wallets are not expensive, not anymore, safe up some money and buy one, many people still advice others to use mobile wallets, even crypto wallets for phones advice people to store keys in cloud, it's crazy and confusing at the same time.

Avoid all these drama by getting a solid open source hardware wallet, better if it's even an air gapped device.

[Zaguru12]

There are two things I picked from this post, first, that Facebook and other social media who allow these malicious ads on their website without doing their due diligence are also complicit in whatever harm that the ads further does to people who click on them.

I don’t think Social media actually filters scams or anything related to that just like what this forum does except if there is massive scam reports of the platform. It is always advisable to actually stay away from all this ads running and promising huge returns.

Aside that as a crypto enthusiast, your device where most of your wallets are been stored or installed should be cold storage if otherwise such device should never be used for engaging or surfing the internet that much.

[Obim34]

It's really stupid to download any resource from social media, some mistakes are needed to become the victim without pity. -snip-

Moral: you shouldn't use facebook in the first place well, I'm just kidding (not really).

If it hasn't changed, I think that social media are still not responsible for the ads they show. It's a good thing that they were able to detect it in only 1-2 hours, but it is still a very long time looking at the exposure and impact it had.

Funny enough  , since we can't stop using then, we have a solution of limiting how we use them.

Social media accepts ad payments, but felt there has been no proper scrutiny before accepting to promote these ads.

1-2 hours is long enough, the larger amount paid for the ad is the wider population it gets shown on media, with that little time thousands of people must have come across it, at least to our knowledge close to victim.

[tech30338]

This is why we need to update mobile phone although its best to backup them first before upgrade, since developers are aware of this malwares they can do updates that protect our devices, but the best thing we should do is to be careful installing applications, and also where we connect our devices from computers to other networks, like other comments we are still the main reason why we get this malware in the first place because sometimes we are careless.

[pawanjain]

I always find it interesting to see how scammers/hackers use different techniques to lure victims into giving up their privacy.
While many times it is the victims fault the other times the attackers are just too smart.
In this case, since the malware was shown in the form of a bonus, it clearly indicates that they were targeting people who were greedy.
People should understand one basic fact that nobody would give away money for free.

[albon]

I haven't heard of Crocodilus before, but I'm not surprised that this new and dangerous type of malware exists. Scammers are constantly developing these malicious malware, viruses, so staying up-to-date on the types of malware, their dangerous functions, and how to protect against them will be of great beneficial.

What makes this malware dangerous is its ability to bypass Android security restrictions and operate silently in the background without the user noticing that there is a malicious program on their phone stealing their sensitive and secure data. This leads us to the necessity of not opening any links or installing cracked applications or applications from unknown sources or stores. Sensitive crypto-related information should never be stored on an internet-connected device.

[katanic97]

I always find it interesting to see how scammers/hackers use different techniques to lure victims into giving up their privacy.
While many times it is the victims fault the other times the attackers are just too smart.
In this case, since the malware was shown in the form of a bonus, it clearly indicates that they were targeting people who were greedy.
People should understand one basic fact that nobody would give away money for free.

When you look at the situation, scammers are actually quite creative.If they had invested that time into some legitimate job or started a legitimate business, i believe many of them would be very successful.
Unfortunately, there are people who choose to build their path through deception, but when they get caught, they face serious consequences.In this case, they primarily targeted naive elderly people, who unfortunately ended up as victims of such an attack.

[DYING_S0UL]

Moral: you shouldn't use facebook in the first place well, I'm just kidding (not really).
If it hasn't changed, I think that social media are still not responsible for the ads they show. It's a good thing that they were able to detect it in only 1-2 hours, but it is still a very long time looking at the exposure and impact it had.
People usually rely on what they see in "official" sites, as they don't usually know that some of that content is embedded from a different source. In cases like this one, it leads to a lesson that can be too expensive to learn.

This is exactly why our ancestors set out certain rules when exploring new place!

Rule number one: Never visit suspicions links. Even better don't visit any links at all.
Rule number two: Don't download unknown apps, and certainly do not install them.
Rule number three: Last but not least, if you are unsure of something then STOP! Go no further, put a stone to it and drop it into the bottom of the lake.

Since they are able to bypass Android 13 restrictions, I assume I am saved for now. Mine is running on Android 15. And most of the devices comes with A14 or A15 nowadays