Mirax Android malware spreads via fake streaming apps
Original title: Hackers Use Fake Streaming Apps to Spread Mirax Android Malware and Steal Bank Accounts
Mirax banking trojan steals credentials through accessibility abuse and remote control in infections across META region.
Hackers distribute Mirax via low-reputation streaming apps that redirect to droppers. The trojan enables remote phone control, initiates fraudulent transfers, and targets over 20 banking apps. Infections affected thousands of users from March to September 2026. Group-IB identified command-and-control infrastructure and recommended transaction verification.
Unconfirmed: Exact loss figures not fully confirmed
- Thousands of infections in META region
- Targets banking and wallet apps
- Uses accessibility service for control
- SOCKS5 proxy module added in 2026
Impact: remote code execution and credential theft via banking overlays
- 1.reject accessibility requests from entertainment apps
- 2.avoid installs from streaming app redirects
- Malware
- Mirax
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 0d83344fee8973165e5009768c1752095a57f3c1 | 5080be6d3e8092c5ffa5f8 Jul 31, 2026 net.jsbzchba.clientpnzd 0d83344fee8973165e5009768c1752095a57f3c1 Jul 28, 2026 org.xifbep.utilityt50 3a1f9060dad56cd08e87fcaf |
| sha1 | 3a1f9060dad56cd08e87fcafa2c87b99295b3db3 | 5e5009768c1752095a57f3c1 Jul 28, 2026 org.xifbep.utilityt50 3a1f9060dad56cd08e87fcafa2c87b99295b3db3 Aug 4, 2026 Note: IP addresses and domains are intentionall |
| sha1 | 8531fe2db41e9e08525080be6d3e8092c5ffa5f8 | f53c9b49cb43a636bb721d28 Aug 6, 2026 org.xrmhvlfx.litewnj3h 8531fe2db41e9e08525080be6d3e8092c5ffa5f8 Jul 31, 2026 net.jsbzchba.clientpnzd 0d83344fee8973165e5009 |
| sha1 | b9e84889c9760460f53c9b49cb43a636bb721d28 | or redirects. IOCs name sha1 installed net.wgrjvz.toolyt93a b9e84889c9760460f53c9b49cb43a636bb721d28 Aug 6, 2026 org.xrmhvlfx.litewnj3h 8531fe2db41e9e08525080be |
From the original article
3 min read at gbhackers.com
Hackers are using streaming app lures to distribute Mirax. This Android banking trojan lets operators remotely control victims’ phones and initiate fraudulent transfers. Estimated losses reach millions of dollars, although confirmed cases capture only part of the campaign’s impact.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.