Millions of Android smartphones hijacked to mine cryptocurrency

Researchers at Malwarebytes have revealed that millions of Android devices were hacked that used phone processors to mine cryptocurrency. Hackers have been reportedly secretly mining Monero coins from smartphones.                

According to Malwarebytes, researchers stated, “Malvertising and online fraud through forced redirects and Trojanized apps—to cite the two most common examples—are increasingly plaguing Android users. In many cases, this is made worse by the fact that people often don’t use web filtering or security applications on their mobile devices.”

The warning message reads, “Your device is showing suspicious surfing behaviour. Please prove that you are human by solving the captcha.” Researchers explained that the discovery came while they were investigating a separate malware campaign dubbed EITest in late January. They were focusing on testing various malvertising chains that often lead to tech support scams with an Internet Explorer or Chrome user-agent on Windows. However, when they switched to an Android, they were redirected via a series of hops to that cryptomining page.

While Android users may be redirected from regular browsing, it is believed that infected apps containing ad modules are loading similar chains leading to this cryptomining page. This is common in the Android ecosystem, especially with so-called “free” apps.

Malwarebytes recommends that Android phone users use web filters and security software to fend off these hijacks. At the moment, the exact methodology used remains unclear.