Why is zygote asking for superuser permissions? I have a OnePlus One running the latest version of OxygenOS which is rooted for the sole purpose of running CF lumen. I have not installed any other root apps, and only use the Play Store for downloading apps. 

Recently, I got two superuser requests in quick succession from an app called Zygote. 

As another answer had suggested, I checked for any rogue apps with adb shell ps | grep zygote but only one process was listed. So there doesn't seem to be any malware masquerading as zygote. 



Scans from Malwarebytes and Kaspersky didn't turn up anything either. 

I haven't got any other superuser requests from zygote since this first happened about a day ago. 

What's going on?
Do you have Xposed Installer and various modules installed? As I understand it, several xposed modules will use the zygote root process and most likely benign.