Hackers Exploit Samsung Exynos Flaw to Deploy Persistent Cryptominer Inside Victim Device Using Trusted System Process

Summary

CrowdStrike has published research documenting an active campaign exploiting CVE-2026-41203, a privilege escalation vulnerability in Samsung’s Exynos chipset driver for Android, to inject a persistent cryptominer into a trusted system process. The technique abuses Samsung’s secure memory allocation mechanism to place miner code in memory regions appearing to belong to a legitimate Android system service, defeating standard detection. The campaign targets Android devices with Samsung Exynos chipsets sold in Europe, Africa, Asia, and certain other markets. Samsung has not released a patch as of this publication.

Timeline

What Happened

CVE-2026-41203 is a privilege escalation vulnerability in the kernel driver managing memory allocation for Samsung’s Exynos chipset. The driver exposes an ioctl interface for privileged system processes to request secure memory allocations. The vulnerability allows a normal-privilege process to supply crafted parameters to this interface, tricking the driver into allocating memory attributed to a trusted system process. Attackers use this to inject cryptomining code into the memory space of a legitimate Android system service, where Android’s process isolation and security monitoring treat it as part of that service. The miner persists through application-level removal attempts and runs continuously consuming device CPU and battery. CrowdStrike assesses delivery via malicious applications from third-party app stores.

Domain Intelligence

samsung.com — 61.56

samsung.com scores in the low-trust range at 61.56. Samsung is the vendor of the affected Exynos chipset and is responsible for patching CVE-2026-41203. One threat intelligence source has flagged samsung.com but the observation has not been independently corroborated.