Skip to content
Emerging Android Malware Combines Crypto Mining and Data Theft

Emerging Android Malware Combines Crypto Mining and Data Theft

First seen 28 Oct 2026, 13:09 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 15:09 UTC
  • •GhostGrab and MiningDropper are sophisticated Android malware families targeting financial data.
  • •Both malware types utilize cryptocurrency mining alongside data exfiltration techniques.
  • •Active campaigns are reported in regions like India and LATAM, with low detection rates.

Recent reports detail the emergence of sophisticated Android malware, including GhostGrab and MiningDropper, which combine cryptocurrency mining with data theft capabilities. GhostGrab targets banking credentials and OTPs through SMS interception, while MiningDropper employs a modular architecture to deliver infostealers and RATs. Both malware families exploit vulnerabilities in Android applications and utilize advanced evasion techniques to avoid detection. The campaigns are particularly active in regions like India and LATAM, with a significant focus on stealing sensitive financial information. Current analysis indicates a growing trend of hybrid threats in the mobile malware landscape, raising concerns for users and organizations alike. As of now, both malware families are being actively used in the wild, with low detection rates reported.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-28
GhostGrab malware reported
CYFIRMA published a report detailing GhostGrab's capabilities in stealing banking credentials and mining cryptocurrency.
CYFIRMA
2026-10-28
MiningDropper malware identified
Cyble Research reported on MiningDropper's multi-stage payload delivery and its use in infostealer campaigns targeting Indian users.
Cyble
2026-10-28
Ghostbat RAT campaign observed
Cyble noted a rise in malware campaigns masquerading as RTO applications targeting Indian users, linked to GhostBat RAT.
Cyble

More articles in this cluster (3)

Following this threat?

Track BeatBanker in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (33)

1 / 3

Common questions

What types of data are being targeted?
The malware targets sensitive financial information, including banking credentials, OTPs, and UPI PINs.
How are users getting infected?
Infections primarily occur through malicious links in WhatsApp messages and SMS, leading to compromised applications.
What regions are most affected by these malware campaigns?
The campaigns are particularly active in India and LATAM, with a focus on local users.