Introduction In March 2025, ThreatFabric’s Mobile Threat Intelligence team identified a new Android banking Trojan named Crocodilus. Initially detected in test campaigns, Crocodilus has rapidly evolved, expanding its reach across Europe and South America. This malware exhibits advanced capabilities, including device takeover, credential harvesting, and sophisticated obfuscation techniques, posing significant…