Crocodilus is Android banking malware that steals credentials and intercepts authentication flows on compromised devices. Attackers use it to capture banking logins, one-time codes and other sensitive data, then abuse the device for unauthorised transactions. Defenders should monitor for sideloaded apps, accessibility abuse, overlay behaviour and unusual SMS or notification access.
How Crocodilus Works
Crocodilus is Android banking malware built to steal login material and manipulate authentication on a compromised device. It targets the user’s trust in the phone itself, then turns that trust into a path for account access and fraudulent activity.
The malware is dangerous because it can observe what a legitimate app presents, capture what the user enters, and interfere with what the user sees or approves. That means the attacker is not only stealing credentials, but also shaping the authentication experience to make interception harder to notice.
What Crocodilus Steals and Why It Matters
The main prize is banking access data, including usernames, passwords, one-time codes and other sensitive session material. Once those elements are captured, the attacker can often act fast enough to use them before the victim notices or before the session expires.
That creates a practical identity problem, not just a malware problem, because stolen credentials and codes can be used to impersonate the account holder. It also means any organisation or user relying on SMS, notification prompts, accessibility prompts or similar second-factor flows needs to treat the device as part of the authentication boundary.
For defenders, the important lesson is that a mobile device can become both the theft point and the approval point. The malware does not need to defeat the bank directly if it can co-opt the phone that the bank already trusts.
How Infections Commonly Take Hold
Crocodilus is associated with compromised Android devices where the user has installed something they should not have, or granted permissions that go beyond what a normal app needs. Sideloaded apps, accessibility abuse, overlay tricks and excessive access to notifications or SMS are all warning signs because they can provide the visibility and control this malware needs.
Those same behaviours also help it hide in plain sight. An overlay can mimic a real login screen, accessibility services can read screen content or actions, and notification access can expose one-time codes or prompts that were meant to stay private.
In practice, this is why mobile security is partly a permissions problem and partly a trust problem. If the device itself is compromised, even a strong banking policy can be undermined at the point where the user authenticates.
Defensive Monitoring and Response
Detection should focus on the device behaviours described in the primary definition, especially sideloaded software, unusual accessibility activation, overlay behaviour, and unexpected SMS or notification access. A bank, enterprise mobility team or incident responder should treat those as signals that the handset may be acting as an interception layer.
When a compromise is suspected, the response should assume credential exposure, session exposure and possibly transaction tampering. That means reviewing the account for unauthorised activity, invalidating active sessions where possible, and resetting any secrets or factors that may have been intercepted through the device.
For a broader control view, NIST’s control catalogues and guidance on identity, authentication, logging and configuration hardening are useful reference points for building layered defence around mobile access, while MITRE ATT&CK helps map the observable behaviours to adversary techniques.
Risk and Threat Considerations
Crocodilus creates a high-value mobile fraud risk because it can convert a single compromised handset into credential theft, session hijacking and unauthorised transactions. The danger is not limited to one login attempt, because the malware can capture both the secret and the moment of approval.
Failure mechanism: The attacker abuses device trust, overlays, accessibility features and message or notification access to intercept authentication data and impersonate the user during the active session.
Impact: Banking access can be taken over, one-time codes can be replayed or abused, and fraudulent transactions can be authorised from what appears to be a legitimate device.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Crocodilus steals banking credentials and intercepts login flows. |
| IA-5 — Authenticator Management | The malware targets one-time codes and other authenticator material. | |
| SI-4 — System Monitoring | Detection depends on spotting overlay, accessibility, and access-abuse behaviours. | |
| Recommendation — Harden user authentication and monitor for credential interception during mobile logins. Protect, rotate, and invalidate authenticators when mobile compromise is suspected. Monitor mobile endpoints for suspicious app behaviour and anomalous access paths. | ||
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | Sideloading and excessive permissions are key infection enablers on Android. |
| Recommendation — Restrict mobile app installation paths and enforce secure configuration baselines. | ||
| MITRE ATT&CK | T1518 — Software Discovery | Banking malware often profiles the device and installed apps before stealing data. |
| Recommendation — Map device reconnaissance to ATT&CK and look for pre-attack profiling activity. | ||
Practitioner Guidance
What to watch for: Treat unexpected accessibility prompts, overlay permissions, sideloaded apps and abnormal SMS or notification access as investigation triggers rather than nuisance events. On mobile banking estates, those signals often matter more than a generic malware alert because they map directly to the theft path.
Governance implication: Organisations should treat mobile authentication as a device security problem as well as an identity problem. That means the control owner for banking access needs visibility into the device posture that sits in front of the login flow, not just the backend account.