Cybersecurity firm Threat Fabric says it has found a new family of mobile-device malware that can launch a fake overlay for certain apps to trick Android users into providing their crypto seed phrases as it takes over the device.

Threat Fabric analysts said in a March 28 report that the Crocodilus malware uses a screen overlay warning users to back up their crypto wallet key by a specific deadline or risk losing access.

“Once a victim provides a password from the application, the overlay will display a message: Back up your wallet key in the settings within 12 hours. Otherwise, the app will be reset, and you may lose access to your wallet,” Threat Fabric said. 

“This social engineering trick guides the victim to navigate to their seed phrase wallet key, allowing Crocodilus to harvest the text using its accessibility logger.” 

Source: Threat Fabric

Once the threat actors have the seed phrase, they can seize complete control of the wallet and “drain it completely.” 

Threat Fabric says despite it being a new malware, Crocodilus has all the features of modern banking malware, with overlay attacks, advanced data harvesting through screen capture of sensitive information such as passwords and remote access to take control of the infected device. 

Initial infection occurs by inadvertently downloading the malware in other software that bypasses Android 13 and security protections, according to Threat Fabric. 

Once installed, Crocodilus requests accessibility service to be enabled, which enables the hackers to gain access to the device. 

“Once granted, the malware connects to the command-and-control (C2) server to receive instructions, including the list of target applications and the overlays to be used,” Threat Fabric said. 

Once installed, Crocodilus requests accessibility service to be enabled, granting hackers access to the device. Source: Threat Fabric

It runs continuously, monitoring app launches and displaying overlays to intercept credentials. When a targeted banking or cryptocurrency app is opened, the fake overlay launches over the top and mutes the sound while the hackers take control of the device.  

“With stolen PII and credentials, threat actors can take full control of a victim’s device using built-in remote access, completing fraudulent transactions without detection,” Threat Fabric said. 

Threat Fabrix’s Mobile Threat Intelligence team has found the malware targets users in Turkey and Spain but said the scope of use will likely broaden over time. 

Related: Beware of ‘cracked’ TradingView — it’s a crypto-stealing trojan

They also speculate the developers could speak Turkish, based on the notes in the code, and added that a threat actor known as Sybra or another hacker testing out new software could be behind the malware. 

“The emergence of the Crocodilus mobile banking Trojan marks a significant escalation in the sophistication and threat level posed by modern malware.” 

“With its advanced Device-Takeover capabilities, remote control features, and the deployment of black overlay attacks from its earliest iterations, Crocodilus demonstrates a level of maturity uncommon in newly discovered threats,” Threat Fabric added. 

Magazine: Ridiculous ‘Chinese Mint’ crypto scam, Japan dives into stablecoins: Asia Express

Around a quarter of firms listed on the S&P 500 would have invested in Bitcoin by 2030, with treasury managers fearing they could lose their jobs if they missed out on potential Bitcoin gains, a partner at a tech-focused financial advisory firm said.

“I anticipate that by 2030, a quarter of the S&P 500 will have BTC somewhere on their balance sheets as a long-term asset,” Elliot Chun, a partner at Architect Partners, said in a March 28 blog.

Chun said this shift will be driven by treasury managers feeling compelled to at least experiment with Bitcoin (BTC).

“If you tried it and it worked, you’re a genius. If you tried it and it didn’t work, you at least tried. But if you didn’t try and have no good reason, your job may be at risk.”

Strategy (MSTR) is the largest corporate Bitcoin holder of all 89 public-traded firms that currently have Bitcoin on their balance sheets, according to data from BitcoinTreasuries.NET.

One more firm could be added to the list after GameStop’s $1.3 billion convertible notes offering on March 26, which the firm intends to use to buy its first batch of Bitcoin.

Tesla and Block are the only S&P 500-listed firms that hold Bitcoin — meaning at least another 123 S&P 500 firms would need to invest in Bitcoin by 2030 for Chun’s prediction to be correct.

The top 10 largest corporate Bitcoin holders. Source: BitcoinTreasuries.NET

Tech investors and execs expect Bitcoin to keep rising

Bitcoin could soar to the $500,000 to $1,000,000 range or even higher by 2030, according to the likes of ARK Invest CEO Cathie Wood, Galaxy Digital CEO Mike Novogratz, Coinbase CEO Brian Armstrong and Block CEO Jack Dorsey.

Meanwhile, firms adopting Bitcoin treasury strategies have seen a positive impact on their share prices. Strategy, whose stock has surged over 2,000% since its first Bitcoin investment on Aug. 20, 2020 — massively outperforming Bitcoin (781.1%) and S&P 500 (64.8%) over that stretch.

But there’s a big difference between firms that adopt Bitcoin for treasury diversification and risk management and those that restructure their entire business models to become the Bitcoin treasury leader within their industries, Chun said.

“Companies who are implementing this strategy in hopes of replicating MSTR’s performance are positioning for disappointment,” said Chun, who referred to Strategy as a “one-of-one.”

MSTR initially provided US asset managers exposure to Bitcoin at a time when they couldn’t hold Bitcoin directly. That changed when the Securities and Exchange Commission approved a handful of spot Bitcoin exchange-traded fund applications on Jan. 10, 2024.

Related: Bitcoin-to-gold ratio breaks 12-year support as gold price hits a record $3K

Despite the increased adoption, Bitcoin used as a treasury asset remains an “unproven strategy” for firms hoping it will hedge against US dollar and fiat inflation or diversify their treasury for risk management purposes, Chun said.

That said, Bitcoin is still a more flexible treasury asset than gold, according to Chun, who pointed out the challenges in storing and moving gold bars.

On the other hand, Bitcoin is a digital commodity that is GAAP-recognized as a tangible asset with a fungible and liquid profile, he added.

Earlier this month, crypto asset manager Bitwise launched Bitwise Bitcoin Standard Corporations ETF on March 11, which seeks to track companies with at least 1,000 Bitcoin in their corporate treasuries.

Magazine: Bitcoiner sex trap extortion? BTS firm’s blockchain disaster: Asia Express

Bitcoin looks set for a bearish open to mark the last trading day of March and possibly the weakest Q1 performance since 2018. 

Crypto and stock traders’ anxiety over US President Donald Trump’s fresh wave of 25% tariffs on cars imported to the US, the threat of tariffs on the pharmaceutical industry is clearly reflected in BTC’s current downside. Trump’s frequent references to April 2 being “Liberation Day” (the day when an apparent number for “reciprocal tariffs” will be assigned to various countries) also has shaken traders’ confidence. 

At the time of publishing, stock futures have already slipped into the red, with the DOW futures shedding 206 points and the S&P 500 futures down 0.56%. As expected, Bitcoin’s (BTC) price moved in tandem with equities markets, slipping to $81,656 on March 30 and locking in a 7th consecutive day of lower lows. 

US futures markets performance on March 30. Source: X / Spencer Hakimian

After a tumultuous quarter, equities markets look set to close down for the month, with the S&P 500 down 6.3% and the Nasdaq and DOW each registering 8.1% and 5.2% respective losses. 

Bitcoin’s steady decline is a combination of weak demand in spot markets and clear derisking from traders who are reluctant to open fresh positions in BTC’s futures markets. 

Last week’s core Personal Consumption Expenditures (PCE) data showed a higher-than-anticipated uptick in inflation, and March consumer confidence data from the Conference Board showed the monthly confidence index — a metric that reflects respondents’ expectation for income, business and job prospects — at a 12-year low. 

Consumer confidence present situation and future expectations data. Source: The Conference Board

Related: Bitcoin bottom ‘likely’ at $80K, opening door for TON, CRO, MNT and RENDER to rally

Recession odds also continue to rise, with a recent report from Goldman Sachs raising the 12-month recession probability from their previous 20% to 35%. In the report, Goldman Sachs’ analysts said, 

“The upgrade from our previous 20% estimate reflects our lower growth beeline, the sharp recent deterioration in household and business confidence and statements from White House officials indicating greater willingness to tolerate near-term economic weakness in pursuit of their policies.”    

US recession odds raised by Goldman Sachs. Source: X / Peter Berezin

Does Bitcoin’s downside have a silver lining? 

While many crypto analysts have publicly revised their bullish six-figure-plus BTC price estimates and now forecast a revisit to Bitcoin’s swing lows in the mid $70,000 range, institutional investors continue to buy, and net inflows to the spot ETFs remain positive. 

On March 30, Strategy CEO Michael Saylor took to X and posted his famous orange dots Bitcoin chart, saying, 

“Needs even more Orange.” 

Strategy Bitcoin purchases. Source: X / Michael Saylor 

Data from CryptoQuant also shows Bitcoin inflows to accumulation addresses continuing to rise throughout the month. 

BTC: Inflows to accumulation addresses. Source: CryptoQuant 

This article does not contain investment advice or recommendations. Every investment and trading move involves risk, and readers should conduct their own research when making a decision.