{"id":65446,"date":"2014-04-26T16:50:29","date_gmt":"2014-04-26T14:50:29","guid":{"rendered":"http:\/\/onsoftware.en.softonic.com\/?p=65446"},"modified":"2025-07-02T00:43:53","modified_gmt":"2025-07-02T07:43:53","slug":"bitcoin-mining-malware-found-in-google-play-store","status":"publish","type":"post","link":"https:\/\/cms-articles.softonic.io\/en\/bitcoin-mining-malware-found-in-google-play-store\/","title":{"rendered":"Malware found in Google Play Store mined Bitcoin"},"content":{"rendered":"<p>Security company Lookout found <a href=\"http:\/\/en.softonic.com\/android\/wallpapers\" target=\"_self\" rel=\"noopener noreferrer\">wallpaper apps<\/a> in the Google Play store that contained malware called \u2018<strong>Bad Leprecon<\/strong>\u2019, which uses your phone\u2019s processor to mine <a href=\"http:\/\/news.en.softonic.com\/b\/bitcoin\" target=\"_self\" rel=\"noopener noreferrer\">Bitcoin<\/a>, the virtual currency.<\/p>\n<p>Five examples of \u2018live wallpaper\u2019 apps were discovered and removed by Google after the malware was found. In this case, each app only had between 100 and 500 downloads, so luckily not many people were affected.<\/p>\n<p>The apps in question did perform their advertised task &#8211; giving you live wallpapers. However, every five seconds the apps scanned your phone to check the battery level, connectivity, and whether the phone\u2019s display was on. If the battery was over 50% charged, the display off and a network connection available, the app will start using your phone to mine Bitcoin. This would run down your device battery, and use your data plan.<\/p>\n<p style=\"text-align: center\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-65449\" title=\"Epic Smoke Live Wallpaper malware\" src=\"https:\/\/articles-img.sftcdn.net\/sft\/articles\/auto-mapping-folder\/sites\/3\/2014\/04\/epic-smoke-568x355.jpg\" alt=\"\" width=\"568\" height=\"355\" srcset=\"https:\/\/articles-img.sftcdn.net\/auto-mapping-folder\/sites\/3\/2014\/04\/epic-smoke-568x355.jpg 568w, https:\/\/articles-img.sftcdn.net\/auto-mapping-folder\/sites\/3\/2014\/04\/epic-smoke-256x160.jpg 256w, https:\/\/articles-img.sftcdn.net\/auto-mapping-folder\/sites\/3\/2014\/04\/epic-smoke.jpg 1280w\" sizes=\"auto, (max-width: 568px) 100vw, 568px\" \/>One of the malware wallpaper apps, Epic Smoke Live Wallpaper.<\/p>\n<p>One phone will not be able to mine many Bitcoins, but the malware creates a network of phones, which together would have created quite a powerful resource. The apps did not explain to users that they mined Bitcoin while you were not using the device.<\/p>\n<p>These wallpaper apps are not the first to hide currency mining in their code. In March, two apps, Songs and Prized were discovered to be mining crypto-currencies, and they each had between one and five million downloads. Both were also removed from Google Play, but the malware has been found packaged with other apps that are available outside Google\u2019s official store.<\/p>\n<p>This highlights the danger of using some unofficial stores, and is also yet another example of malware finding its way into Google Play.<\/p>\n<p>Symptoms of having this kind of malware are faster than usual battery drainage, phones running \u2018hot\u2019 even when you\u2019re not using them or phones that charge unusually slowly.<\/p>\n<p>Source: <a href=\"https:\/\/blog.lookout.com\/blog\/2014\/04\/24\/badlepricon-bitcoin\/\" target=\"_blank\" rel=\"noopener noreferrer\">Lookout Blog,<\/a> <a href=\"http:\/\/www.theguardian.com\/technology\/2014\/mar\/27\/android-bitcoin-dogecoin-mining-malware\" target=\"_blank\" rel=\"noopener noreferrer\">The Guardian<\/a><\/p>\n<h4>RELATED STORIES<\/p>\n<ul>\n<li><a href=\"http:\/\/news.en.softonic.com\/badnews-malware-discovered-in-google-play\">BadNews malware discovered in Google Play<\/a><\/li>\n<li><a href=\"http:\/\/news.en.softonic.com\/google-play-services-to-scan-for-malware-constantly\">Google Play Services to scan for malware constantly<\/a><\/li>\n<li><a href=\"http:\/\/news.en.softonic.com\/virus-shield-scam-app-rose-to-1-in-google-play-before-discovery\">Virus Shield scam app rose to #1 in Google Play before discovery<\/a><\/li>\n<\/ul>\n<\/h4>\n","protected":false},"excerpt":{"rendered":"<p>Security company Lookout found wallpaper apps in the Google Play store that contained malware called \u2018Bad Leprecon\u2019, which uses your phone\u2019s processor to mine Bitcoin, the virtual currency. Five examples of \u2018live wallpaper\u2019 apps were discovered and removed by Google after the malware was found. In this case, each app only had between 100 and &hellip; <a href=\"https:\/\/cms-articles.softonic.io\/en\/bitcoin-mining-malware-found-in-google-play-store\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Malware found in Google Play Store mined Bitcoin&#8221;<\/span><\/a><\/p>\n","protected":false},"author":2019,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wpcf-pageviews":0},"categories":[],"tags":[2422],"usertag":[],"vertical":[],"content-category":[],"class_list":["post-65446","post","type-post","status-publish","format-standard","hentry","tag-app-subdomain-redirectiongoogle-play"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/65446","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/users\/2019"}],"replies":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/comments?post=65446"}],"version-history":[{"count":1,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/65446\/revisions"}],"predecessor-version":[{"id":330875,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/65446\/revisions\/330875"}],"wp:attachment":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/media?parent=65446"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/categories?post=65446"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/tags?post=65446"},{"taxonomy":"usertag","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/usertag?post=65446"},{"taxonomy":"vertical","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/vertical?post=65446"},{"taxonomy":"content-category","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/content-category?post=65446"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}