Mirax Android RAT Hijacks Phones Through Streaming-App Ads to Steal Banking Credentials and Drain Accounts

An Android banking malware campaign is turning streaming-app advertisements into a route for stealing credentials and draining accounts.

Mirax, the remote access trojan lets criminals watch infected phones, intercept security codes, and operate banking apps directly from victims’ devices.

Thousands of Android phones belonging to retail banking customers across the Middle East, Turkey, and Africa were infected between March and September 2026.

Confirmed cases point to losses reaching millions of US dollars, although the available figures cover only infections and fraud visible to investigators and affected banks.

Group-IB researchers identified the campaign in a November 5 investigation, reporting activity spikes during Eid and late July. The operation remained active when the report was published, with streaming apps assessed as possible advertising vectors still available on Google Play.

Mirax Android RAT Hijacks Phones Through Streaming-App Ads

Evidence suggests the infection begins inside low-reputation streaming apps downloaded from Google Play. Advertisements and video links direct users toward a separate installer downloaded outside the store.

This differs from Perseus streaming app attacks, which use fake IPTV applications distributed through sideloading, but both exploit demand for entertainment.

One confirmed installer posed as “TikTok 18+,” an imitation unrelated to TikTok or ByteDance. It retrieves the Mirax payload, which impersonates Google Play Services using a Cyrillic letter that resembles the Latin “o.”

The disguise makes a dangerous permission request appear connected to a familiar system component. Accessibility access is the turning point. Mirax pushes victims toward enabling this permission, then uses it to read screen content and control the interface.

Similar Android banking overlay attacks combine permission abuse with counterfeit login screens, helping attackers capture credentials while users believe they are interacting with legitimate applications.

Mirax also intercepts SMS messages and notifications, records typed information, and captures lock-screen PINs, passwords, or patterns.

Operators can replay those secrets to unlock phones unattended, open banking sessions, add beneficiaries, and initiate transfers.

Since transactions originate from the customer’s genuine phone and banking app, familiar device signals provide less reassurance. Researchers found evidence of international transfers, internal account movements, and marketplace purchases.

Some proceeds may have passed through mule accounts in India, but investigators were still tracing destinations. The findings do not establish that every transfer followed the same laundering route.

Server-Controlled Features Complicate Detection and Response

Mirax separates its installed capabilities from its targeting instructions. Banking overlays and application mappings arrive from command-and-control infrastructure after installation rather than being packaged inside the Android application.

The observed operation targeted more than 20 banking and wallet packages, alongside global cryptocurrency exchanges. Two WebSocket channels separate commands from stolen data, while HTTP long-polling provides a fallback.

Operators can remotely change hosts, ports, TLS settings, and polling intervals. DNS-over-HTTPS is enabled by default, reducing visibility through local DNS monitoring. Static inspection therefore cannot reveal every target or configuration deployed against a particular victim.

A SOCKS5 module also turns compromised phones into residential proxies. Earlier reporting on Mirax residential proxy capabilities described how this routes malicious traffic through victims’ connections.

Combined with device takeover, it can weaken checks based on IP reputation and location, without requiring attackers to operate from their own infrastructure.

The malware hides its launcher icon, randomizes package names, and restores activity after reboots. It can obstruct uninstall screens, block security applications, and display black overlays or fake updating messages while fraudulent activity continues underneath.

These controls extend the time operators have to exploit an infection. Group-IB recommends checking Accessibility abuse, remote-control activity, and screen sharing alongside transaction attempts.

Banks should escalate suspicious combinations and hold payments for customer verification. Users should reject unexpected Accessibility requests from entertainment apps, avoid advertised APK downloads, and seek removal support when a suspicious app resists uninstallation. Indicators remain useful, but rotating identifiers make behavioral detection essential.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.