EN PT-BR
← Voltar ao feed
high finance cryptocurrency

Mirax Android banking trojan spread via fake streaming apps enables remote device takeover and fraudulent transfers in META region

1 fonte(s) · 1 atualização(ões) · publicado 06/11/2026 07:13 · coletado há 2 horas

Group-IB reported on November 5, 2026 that the Mirax Android banking trojan is being distributed through low-reputation streaming apps on Google Play. Ads and video links inside those apps redirect victims to an externally downloaded dropper. One confirmed dropper posed as "TikTok 18+". Researchers did not establish that the Mirax payload itself was distributed through Google Play. Group-IB confirmed thousands of infections among retail banking customers across the META region between March and September 2026, with surges during Eid and late July. It estimates losses in the millions of dollars, though confirmed cases capture only part of the impact. The malware has been advertised on Russian-language criminal forums since December 2025 by a developer using the handle MiraxBot, who reportedly limits access to vetted affiliates.

Detalhes técnicos

  • The payload impersonates Google Play Services, using a Cyrillic lookalike character in the name. It pushes victims to enable Accessibility Service access.
  • Capabilities include keylogging, SMS and notification interception, HTML overlays, screen sharing, and theft and replay of lock-screen secrets to unlock the device unattended.
  • Operators can open the legitimate banking app and execute transfers from the victim's own device and session. This weakens device-trust checks.
  • Overlay templates and app mappings are delivered after installation, so identical samples can target different institutions. Server responses showed targeting of more than 20 regional banking and wallet apps and crypto exchanges.
  • Campaign tags: aquafina and aquafina_all.
  • C2 uses two WebSocket channels, one for commands and one for exfiltration, with HTTP long-polling as a fallback. Operators can remotely change hosts, ports, TLS settings, polling intervals and DNS-over-HTTPS behavior.
  • Evasion and persistence: randomized package names, rotating labels, hidden launcher icons, broadcast receivers, uninstall blocking, interference with security apps and fake updating screens.
  • A SOCKS5 module added in February 2026 turns infected phones into residential proxies.
  • Suspected mule accounts, including in India, received international transfers. Tracing was ongoing.

Remediação

  • Banks: correlate active transactions with remote-control, screen-sharing and accessibility-abuse signals, and hold suspicious payments for customer verification.
  • Users: reject accessibility requests from entertainment apps, and avoid installing software offered through streaming ads or redirects.
  • Group-IB's report provides file hashes, network indicators and the observed command inventory. The article does not reproduce them.

Linha do tempo

  1. gbhackers.com ↗ · pub. 06/11/2026 07:13 · coletado 06/11 08:00 primeiro registro

    Mirax Android banking trojan spread via fake streaming apps enables remote device takeover and fraudulent transfers in META region

    ler a análise desta fonte

    Group-IB reported on November 5, 2026 that the Mirax Android banking trojan is being distributed through low-reputation streaming apps on Google Play. Ads and video links inside those apps redirect victims to an externally downloaded dropper. One confirmed dropper posed as "TikTok 18+". Researchers did not establish that the Mirax payload itself was distributed through Google Play. Group-IB confirmed thousands of infections among retail banking customers across the META region between March and September 2026, with surges during Eid and late July. It estimates losses in the millions of dollars, though confirmed cases capture only part of the impact. The malware has been advertised on Russian-language criminal forums since December 2025 by a developer using the handle MiraxBot, who reportedly limits access to vetted affiliates.

    Technical Details

    • The payload impersonates Google Play Services, using a Cyrillic lookalike character in the name. It pushes victims to enable Accessibility Service access.
    • Capabilities include keylogging, SMS and notification interception, HTML overlays, screen sharing, and theft and replay of lock-screen secrets to unlock the device unattended.
    • Operators can open the legitimate banking app and execute transfers from the victim's own device and session. This weakens device-trust checks.
    • Overlay templates and app mappings are delivered after installation, so identical samples can target different institutions. Server responses showed targeting of more than 20 regional banking and wallet apps and crypto exchanges.
    • Campaign tags: aquafina and aquafina_all.
    • C2 uses two WebSocket channels, one for commands and one for exfiltration, with HTTP long-polling as a fallback. Operators can remotely change hosts, ports, TLS settings, polling intervals and DNS-over-HTTPS behavior.
    • Evasion and persistence: randomized package names, rotating labels, hidden launcher icons, broadcast receivers, uninstall blocking, interference with security apps and fake updating screens.
    • A SOCKS5 module added in February 2026 turns infected phones into residential proxies.
    • Suspected mule accounts, including in India, received international transfers. Tracing was ongoing.

    Remediation

    • Banks: correlate active transactions with remote-control, screen-sharing and accessibility-abuse signals, and hold suspicious payments for customer verification.
    • Users: reject accessibility requests from entertainment apps, and avoid installing software offered through streaming ads or redirects.
    • Group-IB's report provides file hashes, network indicators and the observed command inventory. The article does not reproduce them.