ChainCatcher 消息，黑客通过仿冒 Google Play 商店的钓鱼页面，在巴西发起 Android 恶意软件攻击活动。目前所有已知受害者均位于巴西。
攻击者搭建了与 Google Play 高度相似的钓鱼网站，诱导用户下载名为“INSS Reembolso”的伪造应用。该应用安装后，将分阶段释放隐藏恶意代码，并直接加载至内存运行，设备上不留可见文件，具有较强的隐蔽性。恶意软件的核心功能之一为加密货币挖矿，内置针对 ARM 设备编译的 XMRig 挖矿程序，可在后台静默连接攻击者控制的挖矿服务器。该程序会监控电池电量、温度及设备使用状态，动态调整挖矿行为以规避检测，并通过循环播放静音音频文件绕过 Android 系统的后台进程管理机制。
部分变种还内置银行木马，可在 Binance 和 Trust Wallet 的 USDT 转账界面叠加伪造页面，静默替换收款地址。此外，恶意软件支持录音、截屏、键盘记录及远程锁机等多项远程控制指令。
Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.