Hackers forged Google Play Store pages to carry out cryptocurrency mining and wallet hijacking attacks targeting Brazilian users
Hackers have launched Android malware attacks in Brazil by spoofing a phishing page that mimics the Google Play Store. Currently, all known victims are located in Brazil.
The attackers set up a phishing website that closely resembles Google Play, enticing users to download a fake application called "INSS Reembolso." Once installed, the application releases hidden malicious code in stages and loads it directly into memory, leaving no visible files on the device, which makes it highly stealthy. One of the core functions of the malware is cryptocurrency mining, with an embedded XMRig mining program compiled for ARM devices that silently connects to the attacker's controlled mining server in the background. The program monitors battery level, temperature, and device usage status, dynamically adjusting mining behavior to evade detection, and bypasses Android's background process management mechanism by looping silent audio files.
Some variants also include banking trojans that can overlay fake pages on the USDT transfer interface of Binance and Trust Wallet, silently replacing the recipient address. Additionally, the malware supports various remote control commands such as recording, screenshotting, keylogging, and remote locking of the device.
-- Price
This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.
You may also like

Ethereum EIP-8363 Draft Sparks Controversy Over Reward Burning Proposal

Zerohash files second OCC trust bank application

Owning One Bitcoin Is 70 Times Rarer Than Being a Millionaire

Kalshi Raises $1.12 Billion: Predictive Markets Financing Heading Towards IPO in 2027

POSCO International's U.S. Subsidiary Records Trade Receivables on Avalanche

Decline in Crypto Loans: How Is It Different from 2022? – BitPlanet

Cybersecurity Events: USB Worm Targets Crypto Wallets, Apple Closes Hole in Beats Studio Buds

Solana Surpasses Base with 518,400 x402 Transactions

Ethereum EIP-8148 Discusses Adjustment of Automatic Withdrawal Criteria from 32 ETH to 2048 ETH

Cofund Maps Over 24 Bitcoin Covenant Use Cases

Purchase of Cryptocurrency Through Intermediaries Will Be Available to Unqualified Investors

Saudi Arabia Leads Mecca Agreement, Oil Dollar System Faces New Trust Test

Update on Critical Status for Worker Reservations Until September

Ledger Wallet Vulnerability; Users Must Update Ethereum App to Version 1.22.2

Linux 7.3 Expands Support for New RISC-V Extensions

Some Bitcoin holders tax bill is now set when they leave the country instead of when they sell

The Best AI Models for Trading: A Comparison of the Top 10 Models

The Witcher 4 Aims for 2028 as CD Projekt Red Prepares New Content

Gemini enables XRP transfers via XRPL in Singapore

CFTC clashes with U.S. soldier over $400K Polymarket bet

Advertising Crypto Services in Russia: What is Now Allowed and What Remains Prohibited

Ethereum proposal would cut 33,800 ETH issuance and break every deployed Altair light client

POSCO International Completes Receivables Tokenization Pilot on Avalanche

A Ring Sold for $16 Billion, Oura Prepares for IPO in the U.S.

Controversy Over the Relocation of Policy Banks and 24-Hour Foreign Exchange Dealing Rooms

Fundstrat Predicts Ethereum Will Dominate Tokenization and AI

Underrated Narratives to Watch Before the Bull Market

Central Bank Strengthens Control: Cryptocurrency Sales to Be Monitored Due to Misleading Risks

NoOnes crypto platform enters withdrawal-only mode, users urged to withdraw funds














