The new Android trojan Crocodilus exploits accessibility features and targets users in Spain and Turkey.Crocodilus uses overlay attacks, keylogging, and remote access to steal banking and crypto credentials.The trojan supports advanced keylogger capabilities and a wide range of bot and RAT commands.Crocodilus is linked to the threat actor 'sybra' and poses a significant threat to banks and cryptocurrency wallets.