MITRE ATT&CKsoftware (malware)
S9004 Crocodilus
- Domain
- enterprise, mobile
- Platforms
- Android
- Version
- 1.0
- Created
- 2026-02-06
Description
Crocodilus is an Android banking Trojan that was discovered in March 2025. Crocodilus targeted users worldwide, including Turkey, Poland, Argentina, Brazil, Spain, the United States, Indonesia and India. Crocodilus has been customized based on the target location. For example, Crocodilus mimicked major Turkish and Spanish banks for users in Turkey and Spain, while users in Poland saw Facebook advertisements that promoted Crocodilus to claim bonus points.
Related
Uses · MITRE ATT&CK (22)
- T1657 Financial Theft technique
- T1655 Masquerading technique
- T1628.002 User Evasion sub-technique
- T1417.001 Keylogging sub-technique
- T1417.002 GUI Input Capture sub-technique
- T1437.001 Web Protocols sub-technique
- T1626.001 Device Administrator Permissions sub-technique
- T1629.001 Prevent Application Removal sub-technique
- T1636.003 Contact List sub-technique
- T1636.004 SMS Messages sub-technique
- T1646 Exfiltration Over C2 Channel technique
- T1406.002 Software Packing sub-technique
- T1630.001 Uninstall Malicious Application sub-technique
- T1616 Call Control technique
- T1582 SMS Control technique
- T1516 Input Injection technique
- T1512 Video Capture technique
- T1513 Screen Capture technique
- T1406 Obfuscated Files or Information technique
- T1407 Download New Code at Runtime technique
- T1418 Software Discovery technique
- T1453 Abuse Accessibility Features technique
References
- https://www.threatfabric.com/blogs/crocodilus-mobile-malware-evolving-fast-going-global ThreatFabric_Crocodilus_June2025
- https://www.threatfabric.com/blogs/exposing-crocodilus-new-device-takeover-malware-targeting-android-devices ThreatFabric_Crocodilus_March2025