--- title: BeatBanker: both banker and miner for Android | daily.dev description: Kaspersky's GReAT team has uncovered BeatBanker, a sophisticated Android Trojan targeting Brazilian users via a phishing site disguised as the Google Play... canonical: https://daily.dev/posts/beatbanker-both-banker-and-miner-for-android-duqrwtzep twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: BeatBanker: both banker and miner for Android | daily.dev og:description: Kaspersky's GReAT team has uncovered BeatBanker, a sophisticated Android Trojan targeting Brazilian users via a phishing site disguised as the Google Play... og:url: https://daily.dev/posts/beatbanker-both-banker-and-miner-for-android-duqrwtzep og:image: https://api.daily.dev/og/posts/duQRwTzep.png og:image:alt: BeatBanker: both banker and miner for Android og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # BeatBanker: both banker and miner for Android **[Securelist](https://daily.dev/sources/securelist)** · 14 min read · 0 upvotes · 0 comments ## Summary Kaspersky's GReAT team has uncovered BeatBanker, a sophisticated Android Trojan targeting Brazilian users via a phishing site disguised as the Google Play Store. The malware spreads through a fake INSS (Brazilian social security) app and deploys multiple malicious components: an XMRig-based Monero cryptocurrency miner and a banking Trojan that overlays Binance and Trust Wallet screens to steal USDT transactions. A novel persistence mechanism plays an almost inaudible looping audio file to prevent the OS from killing the process. The malware uses Firebase Cloud Messaging as its C2 channel and monitors battery temperature, charging status, and user presence to control mining activity. Newer BeatBanker variants have replaced the banking module with BTMOB RAT — a Malware-as-a-Service remote administration tool evolved from CraxsRAT and CypherRAT — providing full device surveillance including keylogging, screen recording, camera access, and GPS tracking. IoCs and detection signatures are provided. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [MiningDropper: A Global Android Malware Campaign](https://daily.dev/posts/miningdropper-a-global-android-malware-campaign-mpuw6ujyl) · Cyble · 1 upvotes · 0 comments - [New Rokarolla Android malware targets 217 banking, crypto apps](https://daily.dev/posts/new-rokarolla-android-malware-targets-217-banking-crypto-apps-w7sotfpil) · BleepingComputer · 0 upvotes · 0 comments - [A new Android trojan called Rokarolla targets 217 banking apps and can steal your PIN, SMS codes, and crypto wallet funds](https://daily.dev/posts/a-new-android-trojan-called-rokarolla-targets-217-banking-apps-and-can-steal-your-pin-sms-codes-an-sxasbjsfp) · The Next Web · 0 upvotes · 0 comments - [Indonesia Hit by Android Banking App-Cloning Campaign](https://daily.dev/posts/indonesia-hit-by-android-banking-app-cloning-campaign-qhfetvndq) · Dark Reading · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/beatbanker-both-banker-and-miner-for-android-duqrwtzep) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"BeatBanker: both banker and miner for Android","url":"https://daily.dev/posts/beatbanker-both-banker-and-miner-for-android-duqrwtzep","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/beatbanker-both-banker-and-miner-for-android-duqrwtzep"},"datePublished":"2026-03-10T10:05:24.196Z","dateModified":"2026-03-10T10:05:53.130Z","description":"Kaspersky's GReAT team has uncovered BeatBanker, a sophisticated Android Trojan targeting Brazilian users via a phishing site disguised as the Google Play...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/85606ceed5598c64f1682e1cae791386?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/85606ceed5598c64f1682e1cae791386?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Securelist","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Securelist","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e4b9f556af7a4e74a179787362dd5b07","url":"https://daily.dev/sources/securelist"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/beatbanker-both-banker-and-miner-for-android-duqrwtzep","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Securelist","item":"https://daily.dev/sources/securelist"},{"@type":"ListItem","position":3,"name":"BeatBanker: both banker and miner for Android"}]} ```