Kaspersky Lab has found a new mobile malware Roaming Mantis that steals users’ data on mobile phones and can be used for ghost cryptocurrency mining, the company reports.
 
According Kaspersky Lab, earlier the malware used to replace DNS and worked only on Android, however, now it switched to iOS devices.
 
It redirects iOS devices to a phishing site and runs the CoinHive cryptomining script on desktops and laptops. It does so by means of DNS hijacking, making it hard for targeted users to detect that something’s amiss.
 
When you enter a site name in your browser address bar, the browser doesn’t actually send a request to that site. It can’t; the Internet operates on IP addresses, which are sets of numbers, whereas domain names with words are easier for people to remember and input.
 
There are many DNS-hijacking techniques, but the creators of Roaming Mantis have chosen perhaps the simplest and most effective: They hijack the settings of compromised routers, forcing them to use their own rogue DNS servers. That means regardless of what is typed into the browser address bar of a device connected to this router, the user is redirected to a malicious site.