EP 239.5 Deep Dive Crocodilus and The IT Privacy and Security Weekly Update for the Week Ending April 22nd., 2025

“Crocodilus” is a new Android malware aimed at cryptocurrency wallet users, notably in Spain and Turkey but potentially worldwide. It impersonates legitimate apps and tricks users into disclosing seed phrases. By exploiting Android’s accessibility services, it can monitor screens, simulate gestures, bypass two-factor authentication, and drain assets.

ChatGPT’s latest models can analyze images in detail to determine real-world locations—raising privacy concerns, especially around doxxing. OpenAI imposes safeguards, but they may not fully prevent misuse.

“Shadow AI” refers to employees secretly using unauthorized AI tools at work to enhance speed and efficiency. Nearly half admit to it, suggesting organizations must provide better AI solutions rather than simply banning them.

The EU has banned autonomous AI agents in official online meetings over privacy and transparency risks, echoing the broader AI Act’s emphasis on mitigating high-risk AI scenarios.

Serious NFC vulnerabilities allow attackers to exploit firmware in contactless readers with oversized data packets, enabling remote code execution that can crash terminals, steal information, and even force ATMs to dispense cash. Many older systems remain unpatched.

Ransomware attackers significantly increase demands upon finding evidence of a victim’s cyber-insurance—potentially more than five times higher—highlighting the need to secure insurance documents.

U.S. border agents can search electronic devices without warrants. Refusing to unlock can lead to confiscation for citizens or denial of entry for non-citizens. Travelers are advised to minimize stored data, disable biometric locks, and power down devices before crossing borders.