Mirax Android trojan spreads via streaming-app ads to drain bank accounts
- Severity
- High
- Sources
- 1
What happened
Group-IB reports the Mirax Android RAT campaign infected thousands of retail banking customers' devices across the Middle East, Turkey and Africa between March and September 2026, with losses in the millions of US dollars. The initial vector is low-reputation streaming apps on Google Play linking to sideloaded installers, one of which impersonated Google Play Services using a Cyrillic homoglyph. Mirax abuses Accessibility, intercepts SMS, captures lock-screen credentials, uses WebSocket and long-polling C2, DNS-over-HTTPS and a SOCKS5 residential proxy module, and receives banking overlays and targets server-side. Defenders should hunt for Accessibility abuse, remote-control and screen-sharing activity alongside transaction anomalies, and banks should hold suspicious payments for verification.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Reject unexpected Accessibility permission requests, especially from entertainment or streaming apps.
- Avoid installing APK files advertised in streaming apps or video links.
- If a suspicious app resists uninstallation, seek removal support from your bank or device provider.
- Security teams should check for Accessibility abuse and remote-control activity alongside transaction attempts.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Malware
Companies
Products