I have a OnePlus One running the latest version of OxygenOS which is rooted for the sole purpose of running CF lumen. I have not installed any other root apps, and only use the Play Store for downloading apps.
Recently, I got two superuser requests in quick succession from an app called Zygote.
As another answer had suggested, I checked for any rogue apps with
adb shell ps | grep zygote but only one process was listed. So there doesn't seem to be any malware masquerading as zygote.
Scans from Malwarebytes and Kaspersky didn't turn up anything either.
I haven't got any other superuser requests from zygote since this first happened about a day ago.
What's going on?