Crocodilus Malware Targets Global Crypto Wallets

Crocodilus malware has expanded globally, targeting crypto wallets with bank hijacking capabilities. ThreatFabric, a cybersecurity firm, reported this shift on June 3, 2025.

Previous malware campaigns like Cerberus and Alien showed similar characteristics, but Crocodilus’s rapid expansion marks a new phase in crypto-targeted criminal activities. Despite heightened exposure, there’s still no comment from leading crypto figures or regulators.

Recent activity reveals multiple campaigns now targeting European countries while continuing Turkish campaigns and expanding globally to South America

stated the ThreatFabric Security Research Team.

The financial implications remain unclear due to a lack of centralized reporting on stolen amounts. While no organized funding is noted, the campaign is financially motivated. Technologically, it aligns with threats from previous banking trojans impacting crypto assets.

The expansion into new regions has stressed the need for improved security measures among crypto users and application developers. Historical data from similar threats like Hydra and EventBot highlight potential risks and indicate a necessity for robust countermeasures to safeguard assets.

The Crocodilus malware’s global threat has become a significant point of concern, urging cautious adaptation from the crypto community to fend off these modern digital threats.