Family
Trinity
A 2018 miner still spreading in 2026 against a service that shut down in 2019. It mines for nobody, into the void, and hasn't noticed.
Trinity —also known by its package name, com.ufo.miner, which as of 2026 has become com.google.home.tv, or as UFO Miner— appeared in July 2018, a sibling of the ADB.Miner that a few months earlier had become the first Android worm to reuse Mirai’s scanning code.
Its design is disarmingly simple: a five-kilobyte app that opens an invisible browser and loads a web page it carries inside. That page mines cryptocurrency. No encryption, no native code, no obfuscation. They didn’t even change the default name Android Studio gives new projects.
What it does have is the part that makes it immortal: the binary that spreads has no command server. It makes up addresses at random, tries the debugging port blind, and infects whatever it finds. There’s nothing to take down.
And that’s why it’s still here. It mines for Coinhive, which shut down in March 2019. It has spent seven years burning other people’s batteries to earn exactly nothing. Nobody maintains it, nobody updates it and nobody has switched it off.
Or so I thought, until the honeypot brought me the rest of the kit: the binary that hands it out —armoured three times over— and what travelled packed alongside it. The APK turned out to be only the visible half. I open it in chapter 13.
- 10
A miner that got a bit lost
Another APK came in through the debug cable, but this one weighs fifteen times less than the last and doesn't carry a single line of native code. I opened it expecting something mediocre. What I found was a 2018 fossil still infecting phones to mine for a company that shut down seven years ago — and which today, without knowing it, warns its own victims.
Trinity
2026-08 - 13
Three locks, and the key left in
In chapter 10 I caught the miner, but not the thing that hands it out: that part I told on loan, using someone else's analysis. The honeypot holds a grudge, and brought me the whole thing — armoured three times over, with a blob that resisted everything I know how to do. Until I stopped trying to read it.
Trinity
2026-08