Millions of Android App Downloads Infected with Cryptocoin-Mining Code

Researchers have found apps in the Google Play store which are secretly hijacking mobiles to mine cryptocoins.

More than a million Android smartphones are mining cryptocoins without the owners' knowledge, via apps downloaded from Google Play which stealthily incorporate 'hashing' software.

Researchers at security company Trend Micro say they have found at least two apps on the Google Play store, Songs and "Prized", which contain code to join any phone that has them to a cryptocoin-mining "pool". Each app has had between 1m and 5m downloads, meaning that up to 10m phones might be affected. Songs was still available at the time of publication. An email to the developer had not been answered by time of publication.

The subverted apps seem to include a request to run the mining software within their terms and conditions - meaning that once the user clicks "OK" they have in effect given it permission to steal their processing time. Trend Micro criticised "the murky language and vague terminology" of the terms and conditions.

The company also discovered bitcoin-mining code hidden in repackaged versions of Football Manager Handheld and TuneIn Radio outside Google Play. There is no suggestion that the ones on the official store are affected.

Trend Micro was expanding on an initial report by security firm G Data International in February, detailing the malware ANDROIDOS_KAGECOIN.HBTB, which uses the modest processing power of individual mobiles to generate or mine bitcoin, dogecoin and litecoin without the knowledge of the owner of the devices it is running on.

ANDROIDOS_KAGECOIN.HBTB works by injecting legitimate cryptocurrency mining code from an existing app into "repacked" versions of Android apps.

"The miner is started as a background service once it detects that the affected device is connected to the Internet. By default, it launches the CPU miner to connect to a dynamic domain, which then redirects to an anonymous Dogecoin mining pool," explained Trend Micro in a blog post.

The research company Canalys commented that "negative security PR continues to hurt Google Play's brand image." Security researchers have continued to discover malware variants targeting Android. But Trend Micro's discovery is one of the most serious, because it involves apps with huge download numbers that are available on Google Play.

As the blog post points out, mining for cryptocoins in the background when a device is connected to the internet (i.e. throughout the day) saps its battery life, while charging it more often will wear it down in the long term.

"Users with phones and tablets that are suddenly charging slowly, running hot, or quickly running out of batteries may want to consider if they have been exposed to this or similar threats," suggested the company.

Both G Data and Trend Micro sell security software for Android, so have clear commercial reasons for highlighting malware on the platform in order to attract new customers. This also gives them a good reason to have a clear overview of emerging threats to Android devices.