The samples we found run on Windows 10, including Windows 10 S Mode. They fetch a coin-mining JavaScript library by triggering Google Tag Manager in their domain servers. The mining script then begins using the majority of the computers CPU cycles to mine Monero for the operators. Although these apps appear to provide privacy policies, there is no mention of coin mining on their descriptions on the app store. The apps were published between April and December 2018, with most of them published toward the end of the year. Even though the apps were released for a relatively short period of time, a significant number of users may have downloaded them.”]