Cryptocurrency miners found on Microsoft Store

Eight potentially unwanted applications (PUAs) found to contain code that secretly mines for Monero

Around eight potentially unwanted applications (PUAs) have been discovered on the Microsoft Store that use a victim's computer to mine cryptocurrency.

The apps, which included those for computer and battery optimisation, internet search, web browsers, and video viewing and download and came from three developers: DigiDream, 1clean, and Findoo, according to a blog post by security researchers at Symantec,

The researchers said that as soon as the apps are downloaded and launched, they fetch a coin-mining JavaScript library by triggering Google Tag Manager (GTM) in their domain servers.

"The mining script then gets activated and begins using the majority of the computer's CPU cycles to mine Monero for the operators. Although these apps appear to provide privacy policies, there is no mention of coin mining on their descriptions on the app store," researchers said.

When each app is launched, a web domain is silently visited in the background and triggers GTM with the key GTM-PRFLJPX, which is shared across all eight applications.

Researchers said that while GTM is a legitimate tool that allows developers to inject JavaScript dynamically into their applications, these malicious developers abused this to conceal malicious or risky behaviours.

The apps were put on the app store between April and December 2018, the investigation found. And while the apps were only on the store for a short time, a significant number of users may have downloaded them. Researchers said that there were almost 1,900 ratings posted for these apps.

The apps in question are Fast-search Lite, Battery Optimizer (Tutorials), VPN Browsers+, Downloader for YouTube Videos, Clean Master+ (Tutorials), FastTube, Findoo Browser 2019, and Findoo Mobile & Desktop Search apps. Researchers said that they have informed Microsoft and Google about these apps, and they have since been removed from the store. 

The mining JavaScript has also been removed from Google Tag Manager.

The news comes at a time when app stores are coming under increased pressure to improve the effectiveness of their app vetting procedures. Google's Play Store has long been criticised for hosting malicious applications, including those that host so-called 'cryptojacking' code and spyware.

Featured Resources

Unlocking collaboration: Making software work better together

How to improve collaboration and agility with the right tech

Download now

Four steps to field service excellence

How to thrive in the experience economy

Download now

Six things a developer should know about Postgres

Why enterprises are choosing PostgreSQL

Download now

The path to CX excellence for B2B services

The four stages to thrive in the experience economy

Download now

Recommended

1Password targets enterprise customers with Secrets Automation
IT infrastructure

1Password targets enterprise customers with Secrets Automation

14 Apr 2021
PowerShell threats increased over 200% last year
cyber security

PowerShell threats increased over 200% last year

14 Apr 2021
Russia launched over a million cyber attacks in three months
hacking

Russia launched over a million cyber attacks in three months

13 Apr 2021
New DNS vulnerabilities put millions of IoT devices at risk
Internet of Things (IoT)

New DNS vulnerabilities put millions of IoT devices at risk

13 Apr 2021

Most Popular

Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

8 Apr 2021
Xiaomi Redmi Note 10 Pro review: Champagne tastes on a lemonade budget
Mobile Phones

Xiaomi Redmi Note 10 Pro review: Champagne tastes on a lemonade budget

13 Apr 2021