🚨 New Threat: Fake Google Play pages are distributing crypto-mining malware targeting Brazilian Android users. Apps disguised as legitimate software turn devices into Monero (XMR) miners using XMRig.
Some variants also include a banking trojan that intercepts USDT transfers in wallets like Binance & Trust Wallet, replacing recipient addresses with attacker-controlled ones.
Malware employs stealth tactics, adjusting mining based on battery/temp. Command and control via Firebase. Capabilities include audio recording, screen capture, and keylogging.
Initial report by Cryptopolitan.
#crypto #blockchain #news
Blockchain Report
npub1cg…nmysr
2026-03-22 11:00:03 UTC
Author Public Key
npub1cg2ejqexhx88llcve0yxts2exv5q9k0a88l69q0vp7y5n0f2xyfscnmysrPublished at
2026-03-22 11:00:03 UTCEvent JSON
{
"id": "a2dd9aa540bf6483e9a3db3a0fe83f8e6709e20a2d2b87fab1d3266f691aa525",
"pubkey": "c215990326b98e7fff0ccbc865c159332802d9fd39ffa281ec0f8949bd2a3113",
"created_at": 1774177203,
"kind": 1,
"tags": [],
"content": "🚨 New Threat: Fake Google Play pages are distributing crypto-mining malware targeting Brazilian Android users. Apps disguised as legitimate software turn devices into Monero (XMR) miners using XMRig.\n\nSome variants also include a banking trojan that intercepts USDT transfers in wallets like Binance \u0026 Trust Wallet, replacing recipient addresses with attacker-controlled ones.\n\nMalware employs stealth tactics, adjusting mining based on battery/temp. Command and control via Firebase. Capabilities include audio recording, screen capture, and keylogging.\n\nInitial report by Cryptopolitan.\n\n#crypto #blockchain #news ",
"sig": "a0caa9126c74ef256a3e49fe7128fa15e59855df71998e36e51494a12d0bd594358343a4c9df1523cd4aec5389b4f80e57cbdaab7c4fca745b0333e0924332fb"
}