BeatBanker Android malware poses as Starlink app to mine Monero and plant a RAT

Kaspersky has documented BeatBanker, an Android malware family spread through fake Google Play pages as a Starlink app. It combines a Monero miner with either a banking module or, in its newest version, the BTMOB remote access trojan. Its most unusual trick is staying alive by looping a nearly silent audio clip. Mobile developers should look at that persistence method and at how it abuses Android's foreground service model. Teams building financial apps should look at the overlay and address-swap attacks it uses against wallets.

What happened

On 10 March 2026 Kaspersky's Global Research and Analysis Team (GReAT) published research on BeatBanker. All observed infections were in Brazil. Victims reach a phishing page that imitates the Google Play Store and install an APK posing as a Starlink app. The app then shows a fake Play Store "update" screen to get permission to install more packages, which it downloads and loads in the background.

Kaspersky describes these components:

• Crypto miner. A modified XMRig 6.17.0 built for ARM, mining Monero over TLS to attacker-controlled pools, with a proxy fallback. It starts and stops based on battery level, temperature, charging state and whether the user is active, so the phone doesn't get noticeably hot or slow.
• Banking module (earlier campaign). Shows overlays imitating Binance and Trust Wallet and swaps the recipient address in crypto transactions so funds go to the attacker. It also lists installed financial apps and collects browser data.
• BTMOB RAT (newest variant). A malware-as-a-service RAT that auto-grants permissions, hides notifications, captures screen-lock PINs, patterns and passwords, logs keystrokes, records the screen, and accesses the cameras and GPS.

To stay running, BeatBanker uses a component called KeepAliveServiceMediaPlayback. It keeps a foreground notification on screen and loops output8.mp3, a five-second, nearly inaudible clip of Chinese speech, so the system treats it as active media playback and doesn't kill the process. It sends device telemetry through Firebase Cloud Messaging, decrypts hidden DEX code in native libraries, checks for analysis environments, and waits a while after installation before acting.

Who is affected

• Android users in Brazil who sideload apps from fake store pages. Kaspersky doesn't rule out targeting elsewhere.
• Users of Binance, Trust Wallet and other finance apps on infected devices.
• Not Google Play users. Google said it found no apps containing this malware on Play, and that Play Protect can warn about or block it even when it's installed from elsewhere.

What it means for developers and engineering teams

The audio loop abuses a legitimate Android pattern. Since Android 14, apps must declare a foreground service type such as mediaPlayback, and Google Play reviews those declarations. Sideloaded malware never goes through that review, though, and the operating system can't tell a silent loop from a podcast. The lesson for platform defenders is to watch for media sessions that never produce audible output. The lesson for app developers is that a misbehaving app sharing the device can keep running indefinitely.

If you build banking, wallet or payment apps, the threats here are overlays and on-screen manipulation by another app. Useful defences include:

• setHideOverlayWindows(true) (Android 12+, with the HIDE_OVERLAY_WINDOWS permission) on sensitive screens, so other apps' overlays are hidden.
• FLAG_SECURE on screens that show seed phrases, balances or one-time codes, to block screenshots and screen recording.
• Out-of-band confirmation of destination addresses (server-side checks, address-book allowlists, showing the full address again at the signing step), because the malware edits what the user believes they typed.
• Play Integrity API checks and server-side risk scoring for sessions from devices that show signs of compromise.

What to do now

• Don't sideload apps from links or look-alike store pages. Starlink's real app comes from the official stores.
• Review accessibility and install-unknown-apps permissions on your devices, and revoke them from apps that don't need them.
• Run Play Protect scans, and look for an unexplained, persistent media or "service running" notification.
• If infected: back up your data, factory reset, change passwords and screen-lock credentials from a clean device, and move crypto to a new wallet.
• For app teams: add overlay hiding and FLAG_SECURE to sensitive flows, and confirm transaction destinations on the server.
• Detection names to search your mobile threat defence logs for: HEUR:Trojan-Dropper.AndroidOS.BeatBanker and HEUR:Trojan-Dropper.AndroidOS.Banker.*.

Sources

• Kaspersky Securelist: BeatBanker miner and banker research
• Kaspersky press release: new Android malware campaign disguised as Starlink application
• BleepingComputer: New BeatBanker Android malware poses as Starlink app to hijack devices