Mirax Android RAT Exploits Streaming Ads to Steal Banking Credentials
A sophisticated Android banking trojan, Mirax, is hijacking phones through advertisements in streaming apps, tricking users into granting critical permissions to steal banking credentials and drain accounts.
A new wave of Android malware, dubbed Mirax, is leveraging advertisements within streaming applications to compromise user devices and pilfer sensitive banking information. This remote access trojan (RAT) allows attackers to gain full control over infected phones, intercept security codes, and directly operate banking applications, leading to significant financial losses.
Thousands of retail banking customers across the Middle East, Turkey, and Africa have fallen victim to this campaign, which saw a surge in activity between March and September 2026. Investigators have confirmed losses amounting to millions of US dollars, though the full extent of the financial damage is still being assessed. Researchers at Group-IB identified the campaign, noting that the malware remained active at the time of their report, with streaming apps on Google Play still serving as potential infection vectors.
The infection process typically begins when users download low-reputation streaming applications from Google Play. Advertisements and video links within these apps then direct users to download a separate installer, often disguised as legitimate software, from outside the official store. One such installer was found posing as "TikTok 18+," an imitation unrelated to the official TikTok application.
Once installed, the Mirax payload impersonates Google Play Services, using a deceptive character to trick users into granting essential Accessibility access. This permission allows the malware to read screen content and control the device's interface, enabling it to display counterfeit login screens that mimic legitimate banking applications. Beyond overlay attacks, Mirax can intercept SMS messages, record keystrokes, and capture lock-screen credentials, allowing attackers to bypass multi-factor authentication and unlock devices for fraudulent transactions.
Mirax employs a sophisticated command-and-control (C2) infrastructure that complicates detection. Key functionalities like banking overlays and application mappings are delivered dynamically from the C2 servers rather than being embedded in the initial malware package. This allows attackers to target over 20 different banking and cryptocurrency applications and to remotely alter C2 settings, including hosts, ports, and TLS configurations. The malware also utilizes DNS-over-HTTPS to obscure its network traffic, making traditional DNS monitoring ineffective.
Further enhancing its stealth and persistence, Mirax hides its launcher icon, randomizes its package names, and can resist uninstallation attempts. It employs black overlays or fake update messages to mask fraudulent activities while they are in progress. Additionally, a SOCKS5 module allows compromised devices to be used as residential proxies, routing malicious traffic through victims' connections and masking the attackers' origin.
Group-IB recommends that financial institutions enhance their detection capabilities by monitoring for suspicious combinations of Accessibility abuse, remote control activity, and screen sharing. Users are advised to be wary of unexpected Accessibility permission requests, avoid downloading APKs from untrusted sources, and seek assistance if a suspicious app proves difficult to uninstall. While indicators of compromise (IoCs) are provided, the malware's dynamic nature necessitates a strong focus on behavioral detection methods.