Mirax
Latest
Mirax Android trojan spreads via streaming-app ads to drain bank accounts
The Mirax Android remote access trojan has infected thousands of phones belonging to retail banking customers in the Middle East, Turkey and Africa between March and September 2026, according to Group-IB. It starts from low-reputation streaming apps on Google Play that push users to a separate installer, then abuses Accessibility permissions to read the screen, intercept SMS and notifications, capture lock-screen PINs and make transfers. Its banking overlays and targets are fetched from command-and-control servers after installation, so static analysis gives an incomplete picture.
Fake streaming apps spread Mirax Android banking trojan to steal bank accounts
Attackers are distributing the Mirax Android banking trojan through fake streaming app lures. Once installed, it lets operators remotely control devices and initiate fraudulent transfers. Group-IB, which published its investigation on November 5, estimates losses in the millions of dollars, though confirmed cases cover only part of the campaign.