According to Cointelegraph, the Android banking Trojan Crocodilus has recently been upgraded and is now launching attacks on cryptocurrency users and bank customers worldwide. The security company ThreatFabric found that the malware has spread from Türkiye to Poland, Spain, Argentina and other countries. The latest variant can spread malicious programs disguised as browser updates through Facebook ads, using overlay attacks to steal login credentials for banks and encrypted applications. The Trojan has added the function of automatically extracting cryptocurrency wallet mnemonic words and private keys, and can also modify the victim's address book to implant forged "bank support" numbers. Attackers can now commit crimes by renting cryptocurrency theft tools, with a cost of 100-300 USDT per instance. Security experts remind users to be alert to application updates and advertising links from unknown sources.