How to remove a miner from Xiaomi phone completely: from diagnosis to treatment

Introduction: why miners are dangerous for Xiaomi smartphones

Hidden cryptocurrency mining on Xiaomi smartphones has become one of the most insidious threats of 2023-2026. Unlike traditional viruses, miners do not steal your data - they steal the resources of the device, turning it into a "farm" for mining cryptocurrency. Redmi Note, POCO X and Mi 11 models are especially vulnerable due to their powerful Snapdragon 8xxx and Dimensity processors, which are ideal for mining Monero or Ethereum Classic.

To make matters worse, 90% of Android miners are disguised as MIUI systems, which are almost impossible to detect without special tools. For example, com.qualcomm.thermalservice can consume up to 40% of CPUs in the background, and users will write off overheating as “bad firmware.”

Signs of Miners Infection on Xiaomi

The first step is diagnostics. Mining viruses are specific, and their symptoms are often confused with hardware problems.

• 🔥 Overheating even on simple tasks (e.g., +50°C on WhatsApp). Normally for Snapdragon 8 Gen 2, up to 42°C in plain.
• 🔋 Dramatic drop in battery life: If the Redmi Note 12 Pro+ discharges in 4-5 hours without active use, that is a worrying sign.
• ⚡ Suspicious activity CPU in Settings → Battery State → Usage CPU Miners are often masquerading as mediaserver or android.process.acore processes.
• 📉 Internet Slowdown: Miners consume traffic to communicate with pools (e.g. minexmr.com or pool.supportxmr.com).

The critical sign is activity at night. Miners often start when the phone is connected to charging and the screen is off.

1. Connect your phone to charge before bedtime.
2. In the morning, open the settings → Battery → Use schedule.
3. If the chart shows a constant load of 30-70% in the “sleep” mode, it is almost a miner’s guarantee.

How to check Xiaomi phone for miner

For accurate diagnosis, use a combination of system tools and third-party utilities. Start with the built-in MIUI tools:

Verification by "Battery state"

Go to Settings → Battery → Battery status → Using the CPU. Pay attention to:

• 📊 Processes with a constant load of 20%+ (e.g., com.android.systemui should not consume more than 5% in idle).
• 🕒 Operating time: If a process has been running for 10+ hours in a row, it is suspicious.
• 🔍 Unknown names: Miners often masquerade as Google Play Services (but consume 3-5 times more resources).

2. Analysis of network activity

Miners exchange data with pools to find them.

1. Install NetGuard (free on Google Play).
2. Start monitoring traffic for 10-15 minutes.
3. Check for suspicious domains: pool., mine., stratum+tcp://.

Typical “mining” domains in 2026:

💡

If you find a suspicious domain, copy it and check it through VirusTotal service – this will help confirm that it is associated with mining.

Manual removal of the miner: step-by-step instructions

If you've confirmed an infection, delete it. Don't use the antiviruses from Google Play, most of which are useless against today's miners.

Step 1: Remove suspicious applications

Miners often penetrate through:

• 📱 Pirate APK (hacked games modified by TikTok/Instagram)
• 🔗 Fake updates (e.g., Update MIUI 15" before official release).
• 🎮 Free Fire, PUBG Mobile (Ph000)

How to delete:

1. Go to Settings → Applications → Application Management.
2. Sort by installation date – miners are often installed in “packs” with other programs.
3. Delete anything suspicious, especially with ADMIN or SYSTEM_ALERT.

Step 2: Cleaning up the autoload

Miners add themselves to autoboot to start after the reboot. To turn off:

1. Install Autostarts (requires root or ADB).
2. Find processes with the names miner, pool, xmr.
3. Turn off their auto-start and delete.

Step 3: Removal through ADB (for Advanced)

If the miner is embedded in the system processes, ADB will help. Connect the phone to the PC and do:

adb shell pm list packages | grep -i "mine\|pool\|xmr"

Then remove the packages found:

adb shell pm uninstall -k --user 0 com.example.malware

Deleting the miner without losing data (a way for beginners)

If manual methods don't help or you're afraid of damaging the system, use a secure reset.This method saves your files but deletes all apps and settings:

1. Go to Settings → About the phone → Reset settings.
2. Select "Reset all settings" (Do not "Delete all data!").
3. After the reboot, do not restore data from the backup – the miner can return!
4. Install only verified apps from Google Play.

Important: this method does not remove miners embedded in the firmware (for example, through a modified boot.img). If the problem persists after the reset, you need to flash it again.

💡

Backups made after infection may contain a miner. Never restore a system from a suspicious backup!

How to protect Xiaomi from miners in the future

Prevention is the best treatment. Follow the rules.

• 🛡️ Disable the installation from unknown sources (Settings → Applications → Special Rights).
• 🔍 Check application rights: Miners often request ACCESS_BACKGROUND_LOCATION or REQUEST_INSTALL_PACKAGES.
• 📱 Use alternative firmware: LineageOS or Pixel Experience are free of vulnerabilities MIUI.
• 🔄 Update the firmware: MIUI 14+ has closed critical holes used by miners (e.g., the Dirty Pipe vulnerability).

For additional protection:

1. Install Bouncer – it gives temporary permissions to applications.
2. Use NetGuard to block suspicious connections.
3. Check your phone regularly through Malwarebytes (the only antivirus that detects miners on Xiaomi).

What to do if the miner returns after deleting

If the miner appears again, it means:

1. It is embedded in the firmware (for example, through modified recovery).
2. You recovered it from an infected backup.
3. There is a root access on the phone that exploits the malware.

Decisions:

• 🔧 Frisk your phone through the Mi Flash Tool (instructions for your model on the official website).
• 🔒 Close the root access if it has been opened (via Magisk → Uninstall).
• 📦 Remove all backups made after infection.

⚠️ Warning: If a miner comes back after flashing, it could indicate a hardware chip miner (found in fake Xiaomi from unofficial stores).

FAQ: Frequent questions about Xiaomi miners