GhostGrab Android Malware Combines Covert Monero Mining with Financial Credential Theft

GhostGrab is described by CYFIRMA as a sophisticated Android malware family that blends covert Monero mining with financialCredential theft, representing a significant escalation in mobile threats. The malware turns infected devices into Monero miners, draining CPU and battery while quietly stealing data such as online banking credentials, debit card details, OTPs, and other personal information via staged phishing pages embedded in the APK.

CYFIRMA notes that GhostGrab exfiltrates data in real time to a Firebase Realtime Database and uses Firebase Cloud Messaging as its C2 channel, enabling commands for SMS interception, call forwarding, and data uploads; attackers can reroute calls and OTPs to their numbers to bypass two-factor authentication.

The dropper creates command-line parameters for the miner, including a hardcoded Monero wallet, and connects to attacker-controlled pools at pool.uasecurity[.]org:9000, with domains kychelp[.]live and uasecurity[.]org linked to the operation. Dynamic analysis revealed the Firebase backend stored data such as 1,519 captured SMS messages and 32 active client devices, all indexed by a unique device identifier.

The report highlights the use of foreground services and other techniques to maintain long-term control and suggests a coordinated, global infection campaign. 28 October 2025.