SecureList: Hackers in Brazil are spreading Android malware using a fake Google Play page. This malware turns phones into cryptocurrency mining devices (via XMRig) and installs banking trojans. Some variants target Binance and Trust Wallet, changing wallet addresses during USDT transfers to achieve remote control and data theft.
Source: