Mirax Android RAT spread through streaming-app ads hijacks phones to drain bank accounts

What happened

Group-IB published an investigation on November 5 into Mirax, an Android banking trojan and remote access tool. It lets operators remotely control victims’ phones and start fraudulent transfers (GBHackers, Cyber Security News). Both outlets report on Group-IB’s findings. The Group-IB report itself was not among the sources provided.

Scale and timing

• Group-IB confirmed thousands of infections among retail banking customers between March and September 2026, with activity spiking during Eid and late July (GBHackers).
• GBHackers describes the region as “META”. Cyber Security News spells this out as the Middle East, Turkey and Africa (Cyber Security News).
• Both outlets report estimated losses in the millions of US dollars. Both note that confirmed cases cover only part of the campaign.
• The operation was still active when the report was published (Cyber Security News).

Delivery

• The suspected chain starts in low-reputation streaming apps on Google Play. Ads and video links in those apps lead users to a dropper downloaded outside the store.
• Researchers did not establish that the Mirax payload itself was distributed through Google Play (GBHackers).
• Cyber Security News reports that streaming apps assessed as possible ad vectors were still available on Google Play (Cyber Security News).
• The names of those streaming apps are not confirmed in the sources.
• One confirmed dropper posed as “TikTok 18+”, an imitation unrelated to TikTok.
• The payload impersonates Google Play Services, using a Cyrillic character in place of a Latin letter (GBHackers). Cyber Security News specifies the Latin “o” (Cyber Security News).

Capabilities

• The malware pushes victims to enable Android Accessibility Service.
• It then uses keylogging, SMS and notification interception, HTML overlays and screen sharing to capture credentials and codes.
• It captures lock-screen PINs, passwords or patterns and can replay them to unlock the phone unattended.
• Operators open the real banking app on the victim’s phone to add beneficiaries and make transfers. Because the activity comes from the customer’s own device and session, device-trust checks are less effective (Cyber Security News, GBHackers).
• Researchers saw international transfers, internal account movements and marketplace purchases. Some proceeds may have passed through mule accounts in India, and tracing was still ongoing (Cyber Security News).

Targeting and infrastructure

• Targeting configurations arrive from command-and-control servers after installation. They cover more than 20 banking and wallet apps plus cryptocurrency exchanges, so static analysis cannot reveal the full target list (GBHackers).
• The malware uses two WebSocket channels, with HTTP long-polling as a fallback, and DNS-over-HTTPS by default.

Persistence and evasion

• It uses randomized package names and hidden launcher icons.
• It blocks uninstalls, interferes with security apps and shows fake updating screens (Cyber Security News).
• A SOCKS5 module added in February 2026 turns infected phones into residential proxies.

Seller

• GBHackers reports that Mirax has been advertised on Russian-language criminal forums since December 2025 by a developer using the handle MiraxBot, reportedly only to vetted affiliates (GBHackers).

Am I affected?

You may be affected if both of these apply to an Android device:

• Someone installed an app from a link or ad inside a streaming app.
• A “Google Play Services” or similar app then asked for Accessibility access.

Other warning signs reported by the outlets are:

• an app that resists uninstallation
• a hidden or missing launcher icon
• unexplained black screens or “updating” messages

Published indicators include these package names and SHA-1 hashes (GBHackers, Cyber Security News):

• net.wgrjvz.toolyt93a, b9e84889c9760460f53c9b49cb43a636bb721d28
• org.xrmhvlfx.litewnj3h, 8531fe2db41e9e08525080be6d3e8092c5ffa5f8
• net.jsbzchba.clientpnzd, 0d83344fee8973165e5009768c1752095a57f3c1
• org.xifbep.utilityt50, 3a1f9060dad56cd08e87fcafa2c87b99295b3db3

Cyber Security News lists further hashes and package names, and these network and campaign indicators (Cyber Security News):

• domains oscofneuid[.]com and kenobuias[.]com
• campaign tags aquafina and aquafina_all

Package names are randomized, so a miss on these lists does not rule out infection.

What to do now

1. Reject Accessibility requests from entertainment apps, and do not install APKs offered through streaming-app ads or redirects (GBHackers).
2. If a suspicious app resists uninstallation, seek removal support (Cyber Security News). Contact your bank if you see transfers or beneficiaries you did not add.
3. Security teams: hunt for the published package names, hashes, domains and campaign tags. Prioritize behavioral detection, because identifiers rotate (Cyber Security News).
4. Banks: correlate live transactions with remote-control, screen-sharing and Accessibility-abuse signals, and hold suspicious payments for customer verification, as Group-IB recommends (GBHackers).

Sources

• GBHackers: Hackers Use Fake Streaming Apps to Spread Mirax Android Malware and Steal Bank Accounts
• Cyber Security News: Mirax Android RAT Hijacks Phones Through Streaming-App Ads to Steal Banking Credentials and Drain Accounts