Mirax Android RAT drains META bank accounts through fake Google Play Services app

Linha do tempo

1. securityonline.info ↗ · pub. 10/11/2026 05:00 · coletado 10/11 06:00 primeiro registro

   Mirax Android RAT drains META bank accounts through fake Google Play Services app

   ler a análise desta fonte ocultar

   Between March and September 2026, Group-IB confirmed thousands of Android phones of retail banking customers in the META region infected with the Mirax Android RAT, a device takeover malware that lets operators drive victims' banking apps in real time. Group-IB estimates losses in the millions of US dollars and says the campaign is still active (group-ib.com). The lure is a free video streaming app whose ad banners send users to a dropper downloaded outside Google Play. The payload poses as “Google Play Services” and pushes victims to enable Accessibility Service, the single permission that unlocks full remote control. No vendor patch applies, because the campaign relies on user consent rather than a software flaw, so defence depends on detecting behaviour. Criticity is rated critical given the confirmed large-scale compromise, the ongoing activity and fraudulent transfers that look like legitimate customer sessions.

   Technical Details

   • Dropper and lure: one confirmed dropper was disguised as an adult version of TikTok, with no link to TikTok. Infection spikes occurred over the Eid holidays and at the end of July.
   • Accessibility abuse: with Accessibility Service, the RAT reads the screen, intercepts SMS codes and taps through apps. It captures the lock-screen PIN, password or pattern and can replay it to unlock the phone unattended.
   • Evasion: each build uses a random package name, hides its launcher icon, and the campaign rotates app names. It blocks access to its uninstall screen, can stop security apps from launching, and shows black screens, including a fake “updating” message.
   • Fraud operations: operators drive the victim's own banking app remotely. Funds went to new beneficiaries, internal transfers and online shop purchases, and some international transfers reached suspected mule accounts in India. Group-IB reports that the infected devices outnumber the identified samples (group-ib.com).
   • Command and control: the C2 runs two WebSocket channels on one host, one for commands and one for stolen data, with an HTTP long-poll fallback. Almost every connection setting, including ports, TLS and polling intervals, can change remotely. DNS-over-HTTPS hides C2 lookups from local and carrier DNS monitoring.
   • Server-side overlays: phishing overlays are not stored in the app. The server pushes them after checking which banking apps are installed, so inspecting the installed sample shows only what Mirax could do at install time.
   • Residential proxy: a February 2026 update added a SOCKS5 module that turns each infected phone into a residential proxy, so fraud traffic originates from the victim's IP address.
   • Distribution and actor: the RAT has been sold on Russian-language crime forums since December 2025 by a developer using the handle MiraxBot, with access limited to vetted affiliates. All META samples carry the build tag “aquafina”, which ties them to one operation across several C2 hosts. Group-IB has not identified the affiliate behind that campaign.

   Remediation

   • Never install apps from links inside ads, even when the ad appears inside a Play Store app.
   • Treat any app that pushes the user to enable Accessibility Service as suspicious.
   • Check app settings for duplicate or oddly named “Google Play Services” entries.
   • Banks should flag new beneficiaries followed by fast international transfers.
   • Banks should flag sessions where Accessibility or screen sharing is active.
   • Monitor for devices acting as proxies and for unusual DNS-over-HTTPS traffic.
   • Do not rely on detection of the installed sample alone, since Group-IB warns it is likely to remain a step behind.