Two apps in the Play Store, one of them with more than a million downloads, are mining cryptocurrency whenever the device is plugged in for charging.
Identified by the researchers of security firm Trend Micro, the apps are some of the first malware found in the Play Store that uses virtual currency mining to generate profits for its developers. Trend Micro found that the two apps, Songs (1 to 5 million installs) and Prized (10,000 – 50,000 installs) mine Dogecoin or Litecoin, which is later converted into Bitcoin. The apps’ makers cashed in several times, according to the report.
Cryptocurrency mining uses the device’s CPU and GPU to solve complex cryptographic problems. The reward for this energy- and resource-intensive activity is a small cryptocurrency payout, which can later be exchanged for “real” money. Typically, cryptocurrency miners use high-powered custom rigs with multiple GPUs. Mining on less capable computers, such as laptops, tablets, and smartphones, is generally too time consuming to justify the effort. However, if a malware maker is able to harness the power of millions of low-power devices, the returns could be enticing.
“We believe that with thousands of affected devices, cybercriminal accumulated a great deal of Dogecoins,” said Trend Micro’s team, but it’s not clear from the report what “great deal” means. Currently, 1000 Dogecoin can be exchanged for about 60 cents, while 1 Litecoin costs about $15.5. Dogecoin and Litecoin are both variants of Bitcoin, the cryptocurrency that gained worldwide notoriety and made inroads into mainstream acceptance over the past years.
For the unwitting users of the covert mining apps, the negative effects are slow charging speeds, increased bandwidth consumption, and, due to the strain caused by the constant processing, shorter device and battery lifespan.
Trend Micro has reported the two apps to the Play Store team, but as of this writing, they are still available for download.