A dangerous Android malware called Crocodilus has developed a new way to fool smartphone users. It can now secretly add fake names to the contact list on an infected phone. This makes it easier for hackers to pretend they are calling from trusted people or organizations.
How Crocodilus Fools Users
When a phone is infected with Crocodilus, the malware can automatically add new contacts without the owner’s permission. These contacts can be given names that sound familiar or trustworthy, such as banks, service centers, or even personal contacts. If the hacker later calls the victim, the phone will display the fake name instead of the real caller ID, making it easier to trick the user into answering and trusting the call.
This process happens when the malware receives a secret command. It uses Android’s contact system to quickly add these fake names to the local contact list. Since these contacts are saved only on the phone, they won’t appear on other devices linked to the same Google account.
The Malware Has Spread Worldwide
Crocodilus was first discovered in March 2025 by security researchers. In the early days, it mostly affected a small number of users in Turkey. At that time, it already had tools to steal information and control infected phones from a distance. It also tried to trick people by showing fake messages, like warning users to back up their cryptocurrency wallets within 12 hours or lose access.
Recent updates show that the malware is now being used in attacks across many countries. It has also improved the way it hides itself from security checks. The updated version uses more advanced coding methods and stronger encryption to avoid being detected by cybersecurity tools. These changes make it harder for security teams to study and block the malware.
Another serious upgrade is that Crocodilus can now sort and check stolen information directly on the victim’s phone before sending it to the hackers. This helps attackers collect the most useful data quickly and easily.
How to Stay Safe
Crocodilus is growing fast and is becoming more dangerous, mainly because it relies on tricking people instead of only using technical methods. This makes it especially risky for everyday users.
To protect themselves, Android users should download apps only from trusted sources like Google Play and from well-known app makers. It is important to keep security features like Google Play Protect active and avoid installing too many apps, especially those from unknown developers. Having fewer apps reduces the chances of downloading harmful software by mistake.
Users should also be careful with unexpected phone calls, even if the caller name seems familiar. The name might be fake and added by malware to trick the user.