Hidden miners on Android are one of the most insidious threats to smartphones. Unlike viruses that steal data or show ads, miners quietly using the resources of your device to mine cryptocurrency, reducing battery life and overheating the processor. The worst thing in this situation is that many users are unaware of the infection for months, attributing lags and rapid discharge to “the age of the phone” or a “bad application.”

In this article we will analyze all possible methods of detecting and removing the miner from an Android device - from manual checking through the settings to using specialized antiviruses. You will learn which ones should alert you, how to distinguish legitimate software from malicious software, and what to do if a miner (yes, this happens even in 2026). Important: some methods require superuser rights ( system processes should be wary of how to distinguish legitimate software from malicious software and what to do if the miner built into the firmware at the manufacturer level (yes, this happens even in 2026). Important: some methods require superuser rights (root), but we will also provide solutions for devices without root access.

Signs of a miner infection: how to recognize the threat

Android miners rarely show clear symptoms - their main task is to remain undetected. However, there are indirect signsthat should alert you:

  • 🔋 The battery discharges 2-3 times fastereven when the phone is lying idle. For example, overnight the charge drops from 100% to 20% when Wi-Fi is turned off.
  • 🔥 Phone overheats for no apparent reason - the case becomes hot during simple tasks (viewing chats, making calls).
  • 🐢 Severe lags in the interface: applications take a long time to open, animations “slow down”, the keyboard appears with a delay.
  • 📊 Suspicious network activity: traffic is consumed even when all applications are closed (checked in Settings → Network and Internet → Data usage).
  • 🔍 Unknown processes in the task manager (for example, com.android.miner, crypto.service or random sets of letters).

Miners that disguise themselves as system services are especially dangerous. For example, the process mediaserver is normally responsible for playing multimedia, but if it constantly loads the CPU by 50-80%, this is a reason to check. The same applies to android.process.acore or system_ui.

⚠️ Attention: Some "optimizers" and launchers (for example, GO Launcher or DU Battery Saver) themselves can cause similar symptoms. Before searching for a miner, remove all suspicious memory cleaning utilities.
📊 Have you noticed any suspicious activity on your Android device?
Yes, the phone began to slow down and get warm
Yes, but I attributed it to the old battery
No, everything works fine
I'm not sure, I need to check

Step 1: Checking installed applications

Most miners penetrate the device through fake or hacked applications. The first thing to do is analyze the list of installed software. Pay special attention to:

  • 📱 Applications from unknown sources (not from Google Play). "reliable" site, it could have been modified.
  • 🎮 Games and "cheats" for them. Miners are often disguised as mods for Free Fire, PUBG Mobile or Genshin Impact.
  • 💰 Financial utilities (wallets, trackers cryptocurrencies, "free" Bitcoin generators).
  • 🔧 Optimizers and "accelerators" (for example, Clean Master, Speed Booster).

How to check:

  1. Open Settings → Applications → All applications.
  2. Sort the list by installation date (newest first).
  3. Check applications with unfamiliar names or icons (for example, single-color icons without a logo).
  4. Click on the suspicious application and look Permissions. Miners often request access to Internet, Autostart and Work in the background.

If you find something suspicious - don't just delete, first disable autorun (Settings → Applications → [name] → Autorun) and only then uninstall Some miners can recover after a reboot, if you do not disable their services.

☑️ Checklist for checking applications

Done: 0 / 5

Step 2: Analysis of active processes via ADB

If a visual inspection of the applications did not yield anything, but the symptoms remain, it’s time to dig deeper. This method is suitable for experienced users, but we will give step-by-step guide. Android debugging bridge (ADB). This method is suitable for advanced users, but we will provide step-by-step guide.

What you need:

  • 🖥️ Computer with Windows/Linux/macOS.
  • 🔌 USB cable (preferably original).
  • 🛠️ Utility Platform Tools from Google (you can download from official website).

Instructions:

  1. Turn on on your phone Developer mode (go to Settings → About phone and press 7 times on Build number).
  2. Return to Settings → System → For developers and turn on USB debugging.
  3. Connect the phone to the PC and in the command line (terminal) do:
adb devices

(Your device should appear. If not, install the drivers.)

adb shell top -m 10 -t

This command will show top 10 processes by CPU load. Pay attention to:

  • Processes with names like miner, crypto, pool.
  • Unknown UID (user IDs) System processes usually have UID 0, 1000 or 2000.
  • Processes that consume >30% CPU in the background.

If you find a suspicious process, write it down PID (identifier) and execute:

adb shell ps -p [PID] -o NAME,UID,PID,PPID

This will show which application it belongs to. For example, if the process belongs to com.unknown.app - this is a clear sign of a miner.

⚠️ Attention: Do not kill processes through adb shell kill [PID] - this is a temporary solution. again when rebooting. Instead, find and delete its “parent” application.
What to do if ADB does not see the device?

1. Check if USB debugging is enabled on your phone.
2. (cheap cables often do not support data transfer).
3. Install drivers for your model (for example, for Samsung - Samsung USB Driver).
4. On Mac/Linux, you may need a rule for udev (instructions are on the Android Developers website).

Step 3: Using antiviruses (but not all!)

Antiviruses can help in detecting a miner, but not all of them are effective. Many popular solutions (like Avast or AVG) often miss new miners, since they use obfuscation techniques. data-i="157">not all of them are effective

Antivirus Effectiveness against miners Features Link
Malwarebytes ⭐⭐⭐⭐⭐ Specializes in malware, including miners. The free version scans on demand. Google Play
Bitdefender ⭐⭐⭐⭐ Detects miners well, but the plugin for Android is less powerful than the desktop version. Google Play
Kaspersky ⭐⭐⭐⭐ Detects miners, but may conflict with some firmware (for example, on Xiaomi). Google Play
Dr.Web ⭐⭐⭐ Good for Russian-language threats, but may produce false ones response. Google Play

How to scan correctly:

  1. Install the selected antivirus and update the databases.
  2. Run full scan (not fast!).
  3. If a miner is found, follow the antivirus instructions for removal.
  4. After removal Reboot the phone and check the CPU load again.
⚠️ Attention: Some miners block the installation of antiviruses or disguise themselves as them. If the antivirus does not install (“loading error”, “incompatible with the device”), this is a suspicious sign.
💡

Before scanning, turn off the power saving mode - it may interrupt the scan halfway.

Step 4: Manual cleaning for advanced (with root)

If the miner is built into system files or antivirus apps do not see it, you will need superuser rights (root). This method is risky - incorrect actions can damage the phone, but it is the only one that helps in advanced cases.

What to do:

  1. Install Root Explorer or FX File Explorer (with root support).
  2. Go to folders:
    • /system/app/
    • /system/priv-app/
    • /data/app/
  • Look for files with suspicious names:
    • miner, crypto, pool
    • Random character sets (for example, a1b2c3d4.apk)
    • Files with a modification date that coincides with the beginning of the problems
    • Delete the files found and restart the phone.

    Also check cron jobs (if they are on your device):

    adb shell su -c "cat /system/etc/crontab"

    adb shell su -c "cat /system/etc/init.d/*"

    If there are lines with wget, curl or suspicious URLs, delete them.

    ⚠️ Attention: On In some devices (for example Huawei or Honor) system folders can be protected even with root. In this case, only flashing will help.
    💡

    Without root, you will not be able to remove the miners built into the firmware. In this case, the only way out. - reflash the phone with a clean version of Android.

    Step 5: Reflashing the phone (extreme case)

    If nothing helps and the symptoms remain, the miner is most likely built into the firmwareThis is relevant for:

    • 📱 Cheap Chinese smartphones (for example, Doogee, Ulefone, Blackview).
    • 🔧 Phones with custom firmware (unofficial).
    • 📦 Devices purchased secondhand (especially if the seller has “optimized” the system).

    In this case, it will help only full flashing. Instructions:

    1. Find official firmware for your model on the manufacturer's website or on the forum 4PDA.
    2. Download the utility for firmware:
      • For Samsung — Odin.
      • For Xiaomi — Mi Flash Tool.
      • For Qualcommdevices - QFil or Fastboot.
  • Follow the firmware instructions (each model has its own!).
  • After flashing, perform reset to factory settings (Settings → System → Reset settings).

    • Important: before firmware save all the data —they will be erased. Also make sure that the firmware is suitable for your model (for example, Redmi Note 10 Pro and Redmi Note 10 Pro 5G are different devices!).

    What to do if the firmware doesn't help?

    In rare cases, a miner can be built into bootloader or recovery. Then only resoldering the memory chip (at a service center) or buying a new phone will help.

    How to protect yourself from miners in the future

    Removing the miner is half the battle. To prevent it from returning, follow these rules:

    • 🛡️ Do not install APKs from unknown sources (even if “it’s cheaper/faster/without extra water”).
    • 🔍 Check reviews before installing applications in Google Play. Miners often disguise themselves as popular games (for example, Minecraft or Among Us).
    • 🔄 Update regularly Android - new versions fix the vulnerabilities that miners use.
    • 🔋 Monitor battery consumption v Settings → Battery → Usage. Unknown processes with high consumption are a reason to check.
    • 🔒 Disable installation from unknown sources (Settings → Security → Unknown sources).

    We also recommend using DNS filtering to block miner domains. For example, in Settings → Network and Internet → Private DNS enter:

    dns.adguard.com

    This will block access to many malicious servers.

    💡

    If you often install APKs from third-party sites, use VirusTotal for check files before installation. Upload the APK to the site and wait for the analysis of 60+ antiviruses.

    FAQ: Frequently asked questions about miners on Android

    Can a miner physically damage the phone?

    Yes, but constant overheating reduces battery life and can cause it. k bloat of the battery. Also, prolonged load on the processor accelerates chip wear (especially on budget smartphones). In rare cases, overheating can cause components on the motherboard to separate.

    Does resetting to factory settings help?

    Only if the miner was installed as a regular application. If it is built into the firmware or uses vulnerabilities bootloader, resetting will not help. In this case, flashing is needed.

    Is it possible to get infected with the miner through websites?

    Yes, through drive-by mining. Some sites run mining directly in the browser (for example, via JavaScript). To protect yourself:

    • Use a browser with a script blocker (Brave or Firefox c uBlock Origin).
    • Disable JavaScript on suspicious ones sites.
    • Monitor the CPU load when surfing.
    How do miners bypass Google Play Protect?

    Miners use several tricks:

    • Droppers: a harmless application is downloaded by the miner after installation.
    • Code obfuscation: the miner is encrypted and unpacked only when launched.
    • Certificate substitution: attackers steal certificates from legitimate developers.
    • Activation delay: the miner starts working a few days after installation.

    Google Play Protect detects only the most primitive miners. Additional antiviruses are needed for reliable protection.

    Can miners steal data?

    Most miners focus only on mining cryptocurrency, but some Hybrid malware can:

    • Steal browser history (for sale to advertising networks).
    • Intercept SMS (if you have permission to reading messages).
    • Send spam on your behalf (via Telegram or WhatsApp).

    Check the permissions of all applications in Settings → Applications → Permissions.