Loading story…
Researchers reported a large-scale Android malware campaign built around MiningDropper, a modular multi-stage framework used to distribute cryptocurrency miners alongside more dangerous payloads including infostealers, banking malware, and remote access trojans. The operation used phishing pages, social media links, and fraudulent websites to trick users into installing malicious APKs disguised as legitimate apps, and was linked to campaigns targeting users in India, Europe, Latin America, and Asia. Investigators observed more than 1,500 samples in a month, with many showing very low antivirus detection, indicating broad scale and effective evasion.
Technical analysis showed the infection chain began with a trojanized version of the open-source LumoLight Android project and progressed through staged loaders using XOR-obfuscated native code, AES-encrypted payloads, dynamic DEX loading, split-APK reconstruction, and anti-emulation checks. One analyzed sample, distributed as Free Secure – Annulation.apk, displayed a fake Google Play update screen before activating a miner path or installing a final payload such as BTMOB RAT. The delivered malware enabled credential theft, keylogging, Accessibility abuse, remote device control, audio recording, file management, and financial fraud, underscoring MiningDropper’s role as a reusable malware delivery framework rather than a simple crypto-mining dropper.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Cyble Research and Intelligence Labs disclosed a detailed analysis of MiningDropper, describing it as a modular multi-stage Android malware delivery framework that combines cryptocurrency mining with delivery of infostealers, RATs, and banking malware. The report detailed its evasion methods, staged loader chain, trojanized LumoLight origin, and links to major campaign clusters including an infostealer campaign in India and a BTMOB RAT campaign across multiple regions.
Cyble researchers observed more than 1,500 MiningDropper-related Android samples over the course of a month, with many showing very low antivirus detection rates. The volume and low detection suggested broad operational scale and effective evasion by the operators.
Threat actors operated Android malware campaigns using the modular MiningDropper framework to spread malicious APKs disguised as legitimate apps via phishing pages, social media links, and fraudulent websites. The activity targeted users in India, Europe, Latin America, and Asia, including lures themed around RTO services, banks, telecom providers, popular apps, and fraudulent sites delivering BTMOB RAT.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 29 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple Android malware campaigns that used droppers distributed through **Google Play** to install banking trojans and remote-access malware while evading marketplace defenses. Check Point detailed **Clast82**, a dropper embedded in trojanized utility apps that delayed malicious activity until after publication by checking a Firebase-controlled `enable` flag, then fetched payloads from GitHub and pushed victims to allow installs from unknown sources through repeated fake **Google Play Services** prompts. The campaign delivered **AlienBot Banker** and **MRAT**, relied on fake developer accounts and shared infrastructure, and led to the removal of the identified apps from Google Play. Trend Micro later described **DawDropper** as a similar Android dropper operation that also abused **Firebase Realtime Database** and **GitHub** to dynamically retrieve payloads and avoid detection in apps posing as document scanners, cleaners, and QR scanners. DawDropper was used to distribute banking malware including **Octo**, **Hydra**, **Ermac**, and **TeaBot**; researchers said Octo could steal banking credentials, intercept SMS messages, disable **Google Play Protect**, hijack devices, and use **VNC-based** remote screen control while hiding its activity. The findings also tied these campaigns to a broader underground market for **dropper-as-a-service (DaaS)** offerings, showing how commodity delivery infrastructure was being used to scale Android banking malware distribution.
Aug 14, 2026
Researchers reported two malware campaigns that install cryptocurrency miners through trojanized downloads delivered from pirate streaming sites and fake software portals. In one operation, users visiting illicit movie and TV sites were shown a bogus video-plugin update that delivered a ZIP archive containing a legitimate executable and a malicious DLL; the DLL sideloaded a multi-stage miner framework with persistence, defense evasion, a watchdog, a **RAT** component, and CPU/GPU mining modules. The malware, a modified fork of SilentCryptoMiner, used DNS tunneling for execution gating, installed a service named `GoogleUpdateTaskMachineQC`, weakened Windows defenses, injected into `conhost.exe` and `explorer.exe`, and communicated through rotating domains and infrastructure tied to `107[.]172[.]212[.]235`. Microsoft described a related cryptojacking-focused campaign aimed at owners of high-performance PCs, using fake downloads of popular utilities and hardware-monitoring tools that were promoted through SEO poisoning and, more recently, surfaced in AI assistant recommendations. Those ZIP archives also paired a legitimate executable with a malicious DLL for sideloading, then installed **ScreenConnect** for persistent remote access, set registry autoruns and scheduled tasks, added Microsoft Defender exclusions, checked for analysis tools, and used process hollowing to launch payloads inside trusted Windows processes. After profiling infected systems, the attackers fetched GPU miners including **gminer**, **lolMiner**, and **SRBMiner-MULTI**; researchers warned the access could support not only cryptomining but also data theft, lateral movement, and eventual ransomware deployment.
Jun 29, 2026
Researchers detailed **Trojan.AndroidOS.Loapi**, a modular Android malware family spread through advertising campaigns and malicious websites posing as antivirus tools or adult-content apps. Once installed, Loapi aggressively sought device administrator privileges, resisted removal, hid its icon, and could impersonate antivirus activity while connecting to attacker-controlled command-and-control infrastructure for updates and tasking. Loapi’s modules enabled multiple criminal operations from a single infected device, including **ad fraud**, **premium SMS abuse**, **WAP billing fraud**, **web crawling**, **proxy-based DDoS activity**, and **Monero mining**. The report also found technical and infrastructure links to the older **Trojan.AndroidOS.Podec** family, indicating likely common operators, and noted that sustained mining and traffic generation physically damaged a test device, causing its battery to bulge after two days.
Aug 14, 2026