Hackers Use Fake Streaming Apps to Spread Mirax Android Malware and Steal Bank Accounts

Hackers are using streaming app lures to distribute Mirax. This Android banking trojan lets operators remotely control victims’ phones and initiate fraudulent transfers.

Estimated losses reach millions of dollars, although confirmed cases capture only part of the campaign’s impact.

The operation remained active when Group-IB published its November 5 investigation. Researchers linked the infections through embedded campaign tags, aquafina and aquafina_all, observed across samples communicating with multiple command-and-control servers.

Server responses revealed targeting configurations covering more than 20 regional banking and wallet applications, alongside cryptocurrency exchanges.

The suspected delivery chain starts with low-reputation streaming applications available through Google Play.

Evidence suggests advertisements and video links inside these apps redirect users to an externally downloaded dropper. Importantly, researchers did not establish that the Mirax payload itself was distributed directly through Google Play.

One confirmed dropper masqueraded as “TikTok 18+,” an adult-themed imitation unrelated to TikTok. The subsequent payload impersonates Google Play Services, replacing a Latin letter with a visually similar Cyrillic character.

It then aggressively steers victims toward enabling Android Accessibility Service access.

That permission enables interactive device control. Mirax combines accessibility abuse with keylogging, SMS and notification interception, HTML overlays, and screen-sharing capabilities to capture credentials and authentication codes.

It can also steal lock-screen secrets and replay them to unlock the handset unattended.

Rather than merely stealing passwords for later use, operators can open the legitimate banking application and execute transfers directly.

Transactions consequently originate from the customer’s actual device and banking session, making conventional device-trust checks less effective.

Researchers identified international transfers involving suspected mule accounts, including accounts in India, while tracing remained ongoing.

Group-IB confirmed that, thousands of infections among retail banking customers across the META region between March and September 2026, with activity surging during Eid holidays and late July.

Mirax Android Malware

Mirax’s technical distinction is its separation of embedded capabilities from operational configuration.

Banking overlay templates and application mappings arrive after installation, allowing identical samples to target different institutions without requiring another APK release. Static analysis therefore cannot reveal the complete targeting profile.

Its command infrastructure uses two WebSocket channels, separating operator commands from data exfiltration, with HTTP long-polling available as a fallback.

Operators can remotely change hosts, ports, TLS settings, polling intervals, and DNS-over-HTTPS behavior. Default encrypted DNS resolution reduces visibility for defenders relying on local or carrier DNS logs.

Randomized package names, rotating application labels, and hidden launcher icons further weaken signature-based tracking.

Broadcast receivers support persistence, while uninstall blocking, interference with security applications, and fake updating screens help conceal malicious activity.

A SOCKS5 module added in February 2026 also converts infected phones into residential proxies.

Mirax has been advertised on Russian-language criminal forums since December 2025 by a developer using the handle MiraxBot, reportedly restricting access to vetted affiliates.

Its builder and management panel support repeatable deployments rather than isolated attacks.

For banks, Group-IB recommends correlating active transactions with remote-control, screen-sharing, and accessibility-abuse signals, then holding suspicious payments for customer verification.

Its investigation also provides file hashes, network indicators, and the observed command inventory for defensive tracking.

Users should reject accessibility requests from entertainment apps and avoid installing software offered through streaming advertisements or redirects.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.