malware

Crocodilus S9004

Type: malware
Platform: Android
Created: 6 February 2026
Last modified: 23 April 2026

Crocodilus is an Android banking Trojan that was discovered in March 2025. Crocodilus targeted users worldwide, including Turkey, Poland, Argentina, Brazil, Spain, the United States, Indonesia and India. Crocodilus has been customized based on the target location. For example, Crocodilus mimicked major Turkish and Spanish banks for users in Turkey and Spain, while users in Poland saw Facebook advertisements that promoted Crocodilus to claim bonus points.[1][2]

TechniqueBottom 5%

TacticBottom 6%

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

malware

Crocodilus S9004

Type: malware
Platform: Android
Created: 6 February 2026
Last modified: 23 April 2026

TechniqueBottom 5%

TacticBottom 6%

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Crocodilus MITRE reference S9004

Financial Theft T1657 ↗

Crocodilus has stolen cryptocurrency wallet details from victim devices.3 4

Impactno detection rules

Standing S9004

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Crocodilus S9004

Crocodilus S9004

Crocodilus MITRE reference S9004

Standing S9004

Crocodilus MITRE reference S9004

Standing S9004

Reach

Coverage

Crocodilus detections S9004

Crocodilus detections S9004