PhishingPublished 18 Jul 2025

Android Cryptojacker Masquerades as Banking App to Mine Cryptocurrency on Locked Devices

Source AlienVault OTX General

Description

A new Android malware campaign has been discovered, disguising itself as a banking app to covertly mine cryptocurrency on locked devices. The malware, distributed through a phishing website impersonating Axis Bank, downloads and executes a modified version of XMRig, a popular cryptocurrency mining software. It monitors the device's lock state and battery level, initiating mining operations when the device is locked and stopping when unlocked. This stealthy approach allows for persistent mining, leading to excessive heat generation, battery drain, and potential hardware damage. The malware uses multiple hosting platforms to distribute its payload and connects to specific mining pools. Its impact on devices includes high CPU and memory usage, significant temperature increases, and overall performance degradation.

Impact

For European organizations, the impact of this threat can be multifaceted. Employees using Android devices for work purposes may inadvertently install the malware, especially if they are targeted by phishing campaigns impersonating banks or financial institutions. The cryptojacking activity can degrade device performance, leading to reduced productivity and increased IT support costs. Overheating and battery drain may cause hardware failures, resulting in device replacement expenses and potential data loss if devices become inoperable. Additionally, compromised devices could serve as entry points for further attacks or data exfiltration if the malware evolves or is combined with other malicious payloads. The use of banking app impersonation may also erode trust in legitimate financial communications, complicating security awareness efforts. While the malware primarily affects individual devices, the cumulative effect on organizational mobile fleets could be significant, especially in sectors with high mobile device usage. The stealthy nature of the malware complicates detection, increasing the risk of prolonged infection periods. Although no direct data breach or credential theft is reported, the operational disruption and hardware damage risks warrant serious attention.

Defensive guidance

To mitigate this threat, European organizations should implement targeted measures beyond generic mobile security advice: 1) Deploy advanced mobile threat defense (MTD) solutions capable of detecting cryptojacking behaviors and unauthorized mining software on Android devices. 2) Enforce strict application installation policies restricting users from installing apps outside official app stores or from untrusted sources, combined with mobile device management (MDM) controls to monitor and block suspicious apps. 3) Conduct focused phishing awareness training emphasizing the risks of banking app impersonation and instructing users to verify URLs and app sources carefully. 4) Monitor network traffic for connections to known malicious domains such as getxapp.in and pool.uasecurity.org, and block these at the firewall or DNS level. 5) Implement battery and CPU usage monitoring on corporate devices to detect abnormal spikes indicative of cryptojacking. 6) Encourage regular device updates and patching to minimize vulnerabilities that could be exploited by malware. 7) Establish incident response procedures for mobile device infections, including forensic analysis of suspicious apps and hashes provided. 8) Collaborate with financial institutions to raise awareness about phishing campaigns impersonating their brands. These steps will help detect, prevent, and respond to this specific cryptojacking threat effectively.

Indicators of compromise

Domains 3

getxapp.in
pool-proxy.uasecurity.org
pool.uasecurity.org

Hashes 5

617be84b21428a5f7e137a95d073e077
7c3d7cddaf755343a9c32b30739db6e3
ca99c4a78ca038780d6dcc79390388b4
7a47ff4d94420f91418af0a5459e62d60818ef4bSHA1 of 7c3d7cddaf755343a9c32b30739db6e3
9e661480aa5cdd018b2bf93bb2834c9567d5cf95700dfce89ad93693f0bdb781SHA256 of 7c3d7cddaf755343a9c32b30739db6e3

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 18 Jul 2025, 20:31 UTC

Technical details

Indicators of compromise

Domains 3

Hashes 5

Community reviews

Related threats