Malware · 1 source · latest 1h

Mirax Android trojan spreads via streaming-app ads to drain bank accounts

MALWAREGroup-IBredteam/daily · 1 source

Severity: High
Sources: 1

What happened

The Mirax Android remote access trojan has infected thousands of phones belonging to retail banking customers in the Middle East, Turkey and Africa between March and September 2026, according to Group-IB. It starts from low-reputation streaming apps on Google Play that push users to a separate installer, then abuses Accessibility permissions to read the screen, intercept SMS and notifications, capture lock-screen PINs and make transfers. Its banking overlays and targets are fetched from command-and-control servers after installation, so static analysis gives an incomplete picture.

For IT people · Written by AI from 1 source · Wrong?

What to do

Reject unexpected Accessibility permission requests, especially from entertainment or streaming apps.
Avoid installing APK files advertised in streaming apps or video links.
If a suspicious app resists uninstallation, seek removal support from your bank or device provider.
Security teams should check for Accessibility abuse and remote-control activity alongside transaction attempts.

Written by AI from the sources, checked against them

Read the full story at the source