New Crocodilus malware steals encryption wallet keys from Android users

ChainCatcher message, researchers from the security company ThreatFabric stated that a new type of malware, Crocodilus, can steal Android users' wallet recovery phrases. This malware spreads through proprietary drivers and bypasses the security protections of Android 13 (and higher), and installing the malware does not trigger Play Protect.

The malware overlays a fake warning on the screen, urging users to "back up the wallet recovery phrase in settings within 12 hours," or they may risk losing access to their wallet.