Mirax Android banking trojan takes over devices of META bank customers via fake streaming apps and a fake Google Play Services payload

Linha do tempo

1. securityonline.info ↗ · pub. 10/11/2026 05:00 · coletado 10/11 06:00

   Mirax Android RAT drains META bank accounts through fake Google Play Services app

   ler a análise desta fonte ocultar

   Between March and September 2026, Group-IB confirmed thousands of Android phones of retail banking customers in the META region infected with the Mirax Android RAT, a device takeover malware that lets operators drive victims' banking apps in real time. Group-IB estimates losses in the millions of US dollars and says the campaign is still active (group-ib.com). The lure is a free video streaming app whose ad banners send users to a dropper downloaded outside Google Play. The payload poses as “Google Play Services” and pushes victims to enable Accessibility Service, the single permission that unlocks full remote control. No vendor patch applies, because the campaign relies on user consent rather than a software flaw, so defence depends on detecting behaviour. Criticity is rated critical given the confirmed large-scale compromise, the ongoing activity and fraudulent transfers that look like legitimate customer sessions.

   Technical Details

   • Dropper and lure: one confirmed dropper was disguised as an adult version of TikTok, with no link to TikTok. Infection spikes occurred over the Eid holidays and at the end of July.
   • Accessibility abuse: with Accessibility Service, the RAT reads the screen, intercepts SMS codes and taps through apps. It captures the lock-screen PIN, password or pattern and can replay it to unlock the phone unattended.
   • Evasion: each build uses a random package name, hides its launcher icon, and the campaign rotates app names. It blocks access to its uninstall screen, can stop security apps from launching, and shows black screens, including a fake “updating” message.
   • Fraud operations: operators drive the victim's own banking app remotely. Funds went to new beneficiaries, internal transfers and online shop purchases, and some international transfers reached suspected mule accounts in India. Group-IB reports that the infected devices outnumber the identified samples (group-ib.com).
   • Command and control: the C2 runs two WebSocket channels on one host, one for commands and one for stolen data, with an HTTP long-poll fallback. Almost every connection setting, including ports, TLS and polling intervals, can change remotely. DNS-over-HTTPS hides C2 lookups from local and carrier DNS monitoring.
   • Server-side overlays: phishing overlays are not stored in the app. The server pushes them after checking which banking apps are installed, so inspecting the installed sample shows only what Mirax could do at install time.
   • Residential proxy: a February 2026 update added a SOCKS5 module that turns each infected phone into a residential proxy, so fraud traffic originates from the victim's IP address.
   • Distribution and actor: the RAT has been sold on Russian-language crime forums since December 2025 by a developer using the handle MiraxBot, with access limited to vetted affiliates. All META samples carry the build tag “aquafina”, which ties them to one operation across several C2 hosts. Group-IB has not identified the affiliate behind that campaign.

   Remediation

   • Never install apps from links inside ads, even when the ad appears inside a Play Store app.
   • Treat any app that pushes the user to enable Accessibility Service as suspicious.
   • Check app settings for duplicate or oddly named “Google Play Services” entries.
   • Banks should flag new beneficiaries followed by fast international transfers.
   • Banks should flag sessions where Accessibility or screen sharing is active.
   • Monitor for devices acting as proxies and for unusual DNS-over-HTTPS traffic.
   • Do not rely on detection of the installed sample alone, since Group-IB warns it is likely to remain a step behind.
2. gbhackers.com ↗ · pub. 06/11/2026 07:13 · coletado 06/11 08:00 primeiro registro

   Mirax Android banking trojan spread via fake streaming apps enables remote device takeover and fraudulent transfers in META region

   ler a análise desta fonte ocultar

   Group-IB reported on November 5, 2026 that the Mirax Android banking trojan is being distributed through low-reputation streaming apps on Google Play. Ads and video links inside those apps redirect victims to an externally downloaded dropper. One confirmed dropper posed as "TikTok 18+". Researchers did not establish that the Mirax payload itself was distributed through Google Play. Group-IB confirmed thousands of infections among retail banking customers across the META region between March and September 2026, with surges during Eid and late July. It estimates losses in the millions of dollars, though confirmed cases capture only part of the impact. The malware has been advertised on Russian-language criminal forums since December 2025 by a developer using the handle MiraxBot, who reportedly limits access to vetted affiliates.

   Technical Details

   • The payload impersonates Google Play Services, using a Cyrillic lookalike character in the name. It pushes victims to enable Accessibility Service access.
   • Capabilities include keylogging, SMS and notification interception, HTML overlays, screen sharing, and theft and replay of lock-screen secrets to unlock the device unattended.
   • Operators can open the legitimate banking app and execute transfers from the victim's own device and session. This weakens device-trust checks.
   • Overlay templates and app mappings are delivered after installation, so identical samples can target different institutions. Server responses showed targeting of more than 20 regional banking and wallet apps and crypto exchanges.
   • Campaign tags: aquafina and aquafina_all.
   • C2 uses two WebSocket channels, one for commands and one for exfiltration, with HTTP long-polling as a fallback. Operators can remotely change hosts, ports, TLS settings, polling intervals and DNS-over-HTTPS behavior.
   • Evasion and persistence: randomized package names, rotating labels, hidden launcher icons, broadcast receivers, uninstall blocking, interference with security apps and fake updating screens.
   • A SOCKS5 module added in February 2026 turns infected phones into residential proxies.
   • Suspected mule accounts, including in India, received international transfers. Tracing was ongoing.

   Remediation

   • Banks: correlate active transactions with remote-control, screen-sharing and accessibility-abuse signals, and hold suspicious payments for customer verification.
   • Users: reject accessibility requests from entertainment apps, and avoid installing software offered through streaming ads or redirects.
   • Group-IB's report provides file hashes, network indicators and the observed command inventory. The article does not reproduce them.