MiningDropper Turns Android Apps Into Multi-Stage Malware Delivery Systems

Researchers at Cyble identified MiningDropper, a modular Android malware framework abused at scale via a trojanized Lumolight app; it uses XOR/AES obfuscation, dynamic DEX loading, anti-emulation checks and multi-stage payload delivery to deploy cryptocurrency miners, infostealers, banking trojans and RATs (e.g., BTMOB), with campaigns targeting India and multiple global regions and over 1,500 samples observed in a month.