Fake Cryptocurrency Mining Apps Trick Victims Into Watching Ads, Paying for Subscription Service

Due to an increased number of people who are interested in learning about mining cryptocurrency, cybercriminals are actively exploiting people’s interest not just by deploying cryptocurrency-mining malware, but by creating fake Android apps that target those interested in virtual coins.

We recently discovered eight deceptive mobile apps that masquerade as cryptocurrency cloud mining applications (detected by Trend Micro as AndroidOS_FakeMinerPay and AndroidOS_FakeMinerAd), where users can earn cryptocurrency by investing money into a cloud-mining operation. However, upon analysis, we discovered that these malicious apps only trick victims into watching ads, paying for subscription services that have an average monthly fee of US$15, and paying for increased mining capabilities without getting anything in return. We have reported our findings to Google Play, and the apps have been promptly removed from the Play Store.

These are the fraudulent apps that are now no longer available on the Play Store:

• BitFunds – Crypto Cloud Mining
• Bitcoin Miner – Cloud Mining
• Bitcoin (BTC) – Pool Mining Cloud Wallet
• Crypto Holic – Bitcoin Cloud Mining
• Daily Bitcoin Rewards – Cloud Based Mining System
• Bitcoin 2021
• MineBit Pro - Crypto Cloud Mining & btc miner
• Ethereum (ETH) - Pool Mining Cloud

Two of these are even paid apps that users need to purchase; Crypto Holic – Bitcoin Cloud Mining costs US$12.99 to download, while Daily Bitcoin Rewards – Cloud Based Mining System costs US$5.99.

It’s important to note that upon searching the keywords “cloud mining” on Google Play, we still found numerous concerning applications of the same type. Some of these apps have even been downloaded more than 100,000 times.

Based on Trend Micro Mobile App Reputation Service (MARS) data, more than 120 fake cryptocurrency mining apps are still being used by victims. These apps, which do not have cryptocurrency mining capabilities and deceive users into watching in-app ads, have affected more than 4,500 users globally from July 2020 to July 2021. MARS also detects all of these samples as AndroidOS_FakeMinerPay and AndroidOS_FakeMinerAd.

Technical analysis

Apps with no real cryptomining capability

Our analysis of the abovementioned apps confirmed that they did not have any cryptocurrency-mining behavior. The fake mining activity on the apps’ user interface (UI) is carried out via a local mining simulation module that includes a counter and some random functions.

Despite these apps not being associated with cloud-mining operations or having any cryptocurrency-mining features, some of these apps prompt users to pay for increased cryptocurrency-mining capabilities via the apps’ in-app billing systems that range from US$14.99 to as high as $189.99. The app called Daily Bitcoin Rewards – Cloud Based Mining System prompts its users to upgrade their cryptomining capacity by “buying” their favorite mining machines to earn more coins at a faster rate.

Deception at its finest: Game posing as a cryptomining app

Some of these fraudulent applications are listed under the Play Store’s finance category and are described as cloud mining applications on the applications’ display pages.

However, one of these apps’ terms of use states that the app is merely a game that does not have any cryptocurrency-mining functionality. Hence, it will not be obligated to issue cryptocurrency payments to its users. It also does not guarantee a firm return for any virtual goods and features purchased in the app.

If users relied solely on how the application’s UI is configured and designed and didn’t read the app’s terms of use, they may have used it and made in-app purchases without knowing that it’s just a game.  

Fraudulent ad clicks

Our investigation also found that some of these fake cryptomining applications prompted its users to click on ads instead of prodding them to pay for increased computing power. These apps, namely Bitcoin (BTC) – Pool Mining Cloud Wallet and Bitcoin 2021, have the following malicious features:

• The interfaces are flooded with ads.
• Users are prompted to click on ads during fraudulent cryptomining activities to prove that users are not robots.
• Users are informed that they can start mining after viewing video ads within the app.
• Users are informed to watch in-app video ads to increase mining speed.

No cryptocurrency withdrawals supported

Unfortunately, even if users browse in-app ads, they won’t get any revenue. Users are prompted to invite several friends to download the app to unlock the withdrawal interface.

However, even after users are able to invite friends and unlock the withdrawal interface, they wouldn’t be able to withdraw cryptocurrency from the app as it is always in a waiting state. For example, the Bitcoin (BTC) – Pool Mining Cloud Wallet app accesses a link that responds to users’ withdrawal requests:

http://ejemplos.appwebcode.com/?crypto_value=123&wllet=123&pkgname=com.serverpoolbtc.cryptocloudmining.freebitcoincashwallet&cryptocurrency=bitcoin&cryptosiglas=btc

This link is easily accessible on any browser. The cryptocurrency value and withdrawal amount can also be easily altered.

How to recognize a fake cryptocurrency-mining app

The volatility of the cryptocurrency market is not it’s only risk — those interested in mining cryptocurrency must also be aware of the fraudulent cryptocurrency-mining apps.

We provide some helpful tips to determine whether a cryptomining app is fake or otherwise:

1. Carefully read the app’s reviews. Fake apps will receive numerous 5-star reviews once they are released publicly, but don't be fooled by these as they may be false and paid-for reviews. Pay more attention to 1-star reviews.

1. Try to enter an invalid or wrong cryptocurrency wallet address. After extensive analysis, we found that most of the malicious samples only process wallet addresses as non-empty values. Hence, if a user encodes an invalid wallet address and the app accepts it and is able to perform follow-up operations, there is a high probability that the app is fraudulent.
2. Restart the app or phone while it is in the process of mining. Most mining actions for fake apps are just simulated with local counters. This means that if a device is restarted after mining starts and the mining application is killed in the background, the system will forcibly clear the counter, resetting it to zero.
3. Confirm if there is a withdrawal fee. The transfer of cryptocurrency requires a handling fee, which is relatively high compared to what is typically made from cloud mining. Hence, free withdrawals are very suspicious.

Trend Micro Solutions

To avoid these types of threats, users can turn to security solutions that can alert users of fraudulent applications.  Trend Micro™ Mobile Security blocks malicious apps. End users can also benefit from its multilayered security capabilities that secure the device owner’s data and privacy and protect them from ransomware, fraudulent websites, and identity theft.

For organizations, the Trend Micro™ Mobile Security for Enterprise suite provides device, compliance and application management, data protection, and configuration provisioning, as well as protects devices from attacks that exploit vulnerabilities, prevents unauthorized access to apps and detects and blocks malware and fraudulent websites. Trend Micro’s Mobile App Reputation Service (MARS) covers Android and iOS threats using leading sandbox and machine learning technologies to protect users against malware, zero-day and known exploits, privacy leaks, and application vulnerability.

Indicators of compromise (IoCs)

AndroidOS_FakeMinerPay

AndroidOS_FakeMinerAd