Hackers forged the Google Play store page to target Brazilian users with cryptocurrency mining and wallet hijacking attacks

Hackers launched an Android malware attack in Brazil by counterfeiting the phishing page of the GooglePlay store. All known victims are currently located in Brazil. The attacker set up a phishing website highly similar to GooglePlay and induced users to download a fake application called "INSSReembrso". After the application is installed, the hidden malicious code will be released in stages and loaded directly into memory to run. No visible files are left on the device, making it highly concealed. One of the core functions of malware is cryptocurrency mining. It has a built-in XMRig mining program compiled for ARM devices and can silently connect to a mining server controlled by an attacker in the background. The program monitors battery power, temperature and device usage status, dynamically adjusts mining behavior to avoid detection, and bypasses the Android system's background process management mechanism by cycling silent audio files. Some variants also have built-in bank Trojans, which can superimpose forged pages on the USDT transfer interfaces of Binance and TrustWallet to silently replace the collection address. In addition, the malware supports multiple remote control instructions such as recording, screenshots, keylogging, and remote locking.