Hackers spread malicious apps through fake Google Play pages, infecting Android devices on a large scale in Brazil. After users download, phones are converted into cryptocurrency mining devices (such as running XMRig), while some versions also embed banking trojans that intercept USDT transfers in applications like Binance and Trust Wallet, replacing recipient addresses. The malware has strong concealment capabilities, dynamically controlling mining behavior based on battery level and temperature, and remotely controlling devices through legitimate services like Firebase, even supporting features such as audio recording, screenshots, and keystroke logging. (Cryptopolitan)