Share this article
8 Illicit Crypto-Mining Windows Apps Removed From Microsoft Store
Eight apps have been removed from Microsoft's app store after Symantec found they could illicitly mine cryptocurrency.
Updated Sep 13, 2021, 8:53 a.m. Published Feb 15, 2019, 1:00 p.m.
A number of apps in Microsoft's app store have been found to be able to illicitly mine cryptocurrency.
The eight apps, discovered by Symantec on Jan. 17, hosted a version of Coinhive, a script for mining the monero cryptocurrency that has proved popular with cyber criminals.
STORY CONTINUES BELOW
Don't miss another story.Subscribe to the Crypto Daybook Americas Newsletter today. See all newsletters
In a blog post on the discovery, Symantec said it had reported the apps to Microsoft, which subsequently took them down. The apps all ran on Windows 10, including Windows 10 S Mode, which restricts app downloads to the Microsoft Store.
Three developers, DigiDream, 1clean and Findoo, reportedly produced all the apps, which covered the areas of computer and battery optimization tutorials, web search, web browsing, and video viewing and download.
Symantec wrote in the post:
"In total, we discovered eight apps from these developers that shared the same risky behavior. After further investigation, we believe that all these apps were likely developed by the same person or group."
After being downloaded and opened, the apps work by fetching the monero mining JavaScript library by triggering Google Tag Manager in their domain servers. The mining script is then activated and harnesses the bulk of the victim computer’s CPU cycles to mine the cryptocurrency. The JavaScript has also been removed from Google Tag Manager after Google was informed, the post said.
"Although these apps appear to provide privacy policies, there is no mention of coin mining on their descriptions on the app store," Symantec said.
The apps were published from April to December of last year, although most were published toward the end of the year. Despite being on the Microsoft Store for a relatively short period, "a significant number" of users may have downloaded them onto their PCs, said the firm.
Monero is by far the most popular cryptocurrency among bad actors deploying mining malware, according to a study published last month. So much so that the author's of the research estimated that hackers have mined at least 4.32 percent of the total monero in circulation.
“Overall, we estimate there are at least 2,218 active campaigns that have accumulated about 720,000 XMR ($57 million)," they wrote.
Microsoft image via Shutterstock
More For You
What to know:
- As of October 2025, GoPlus has generated $4.7M in total revenue across its product lines. The GoPlus App is the primary revenue driver, contributing $2.5M (approx. 53%), followed by the SafeToken Protocol at $1.7M.
- GoPlus Intelligence's Token Security API averaged 717 million monthly calls year-to-date in 2025 , with a peak of nearly 1 billion calls in February 2025. Total blockchain-level requests, including transaction simulations, averaged an additional 350 million per month.
- Since its January 2025 launch , the $GPS token has registered over $5B in total spot volume and $10B in derivatives volume in 2025. Monthly spot volume peaked in March 2025 at over $1.1B , while derivatives volume peaked the same month at over $4B.
More For You
Bitcoin’s Deep Correction Sets Stage for December Rebound, Says K33 Research
K33 Research says market fear is outweighing fundamentals as bitcoin nears key levels. December could offer an entry point for bold investors.
What to know:
- K33 Research says bitcoin’s steep correction shows signs of bottoming, with December potentially marking a turning point.
- The firm has argued that the market is overreacting to long-term risks while ignoring near-term signals of strength, like low leverage and solid support levels.
- With likely policy shifts ahead and cautious positioning in futures, K33 sees more upside potential than risk of another major collapse.
Top Stories
