Android apps claiming to mine unminable cryptocurrencies have made their way into the Google Play store in an attempt to serve ads.
Fortinet researchers discovered the malicious apps when they noticed apps claiming to mine currencies including Ripple (XRP), Cardano (ADA) and Tether(USDT) all of which aren’t obtained by cryptomining.
Similar apps have been reported as early as February 2018 but researchers believe these apps may have been flying under the radar since May 2018, according to an Oct. 11 blog post.
While running, the app even will display hash speeds as the number of mined coins slowly increases and when a user attempts to withdraw what appears to be their earnings, the app is programmed to display an error message instructing them to check their wallet address.
Meanwhile, the sole purpose of the app is to display ads on the user’s device which subsequently makes them money, the idea being that enticing the users through the promise of cryptocurrency will help ensure they keep the app on the device.
Mike Bittner, digital security & operations manager at The Media Trust said that while cryptomining apps conducting unauthorized or malicious behavior are nothing new, many legitimate mobile app developers and providers remain unaware of the risks their third-party code suppliers pose in terms of infringing a growing number of data privacy regulations.
“Too few even know who their direct and indirect third parties are, let alone what they are doing,” Bittner said.
“Mobile app developers and owners should continuously scan their digital assets in real time in order to find out who is executing what in their digital ecosystem in order ensure they stay compliant with regulations and avoid any unwanted publicity.”
Researchers said the only purpose of these applications is to display ads and collect revenue.
