Mirax Android malware steals bank funds via accessibility services
Original title: New Mirax Android Malware Uses Accessibility Services to Remotely Control Phones and Steal Bank Funds
Group-IB says thousands of retail banking phones in the Middle East, Türkiye and Africa were infected from March to September 2026.
Mirax spreads through ads or video links in low-reputation streaming apps that send users to an installer outside Google Play. After victims enable Accessibility, operators can watch the screen, capture passwords and codes, unlock the phone and move money inside the real banking app. Group-IB published the investigation on November 5 and said the operation was still active, with confirmed losses in the millions of US dollars. Server-supplied overlays cover more than 20 banking and wallet packages.
Unconfirmed: Group-IB’s loss figure is a confirmed baseline, not a full accounting, and tracing of stolen funds was still ongoing.
- One installer impersonated TikTok 18+ and fetched a payload posing as Google Play Services.
- Operators can add beneficiaries and start transfers from the victim’s own phone and app.
- Command and control uses two WebSocket channels, HTTP long-polling and default DNS-over-HTTPS.
- Investigators suggest mule accounts in India; not every payment’s destination is established.
Impact: remote control of phones and theft of bank funds
- 1.Reject unexpected Accessibility requests from entertainment apps and avoid installers from untrusted ads.
- 2.Banks should correlate payments with Accessibility abuse, screen sharing and remote-control signals.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | kenobuias.com | twork domain oscofneuid[.]com Not applicable Network domain kenobuias[.]com Not applicable Confirmed dropper net.hzzor.lite87n9 8c696 |
| domain | oscofneuid.com | 2ll b164a1bf2c7b478ce040e479377526c00885ab7f Network domain oscofneuid[.]com Not applicable Network domain kenobuias[.]com Not applica |
| sha1 | 0d83344fee8973165e5009768c1752095a57f3c1 | e08525080be6d3e8092c5ffa5f8 Payload net.jsbzchba.clientpnzd 0d83344fee8973165e5009768c1752095a57f3c1 Payload org.xifbep.utilityt50 3a1f9060dad56cd08e87fcafa2c87 |
| sha1 | 20068b91036145b3e1b1d7e294b7a2f5ba26bd7f | 6d6bd5da99c10e829cde69a8f5 Payload org.yhjrihi.managerrk9u6 20068b91036145b3e1b1d7e294b7a2f5ba26bd7f Payload io.nmflf.pro4d2ll b164a1bf2c7b478ce040e479377526c00 |
| sha1 | 2b5eeabbc52a25172123c2e7789c977e6bb557af | b5a99b5420538c8b1bfef6fa4fbd7fe Payload io.vvecxa.clientffb 2b5eeabbc52a25172123c2e7789c977e6bb557af Payload io.crxti.systems11f d7b4d33c38deb0978b71ef79ff4df9f |
| sha1 | 3a1f9060dad56cd08e87fcafa2c87b99295b3db3 | 973165e5009768c1752095a57f3c1 Payload org.xifbep.utilityt50 3a1f9060dad56cd08e87fcafa2c87b99295b3db3 Payload io.svmlmt.mobilecu7sq 6a37c3d4beb80ae1689dbbedcb53a |
| sha1 | 413e1c8661ec11fc8e7f9a7caccfc9c54cb1ea3d | 4a3879af819c5cdda3aa5a236c55a25 Payload org.pruvqil.appq1km 413e1c8661ec11fc8e7f9a7caccfc9c54cb1ea3d Payload net.vsqomby.toolc4s1x c8f5abb80e9c936d6bd5da99c10e8 |
| sha1 | 562d8360854005e90ae316c1350b9660ffd3e6f9 | 5cbf31b3e785f21309bb60b9247a4fb4 Payload io.isvac.safemmz7g 562d8360854005e90ae316c1350b9660ffd3e6f9 Payload com.zjper.litewens da997eeb64a3879af819c5cdda3aa5a2 |
| sha1 | 6a37c3d4beb80ae1689dbbedcb53a86f85c8e44a | 56cd08e87fcafa2c87b99295b3db3 Payload io.svmlmt.mobilecu7sq 6a37c3d4beb80ae1689dbbedcb53a86f85c8e44a Payload io.xccqt.helper3mk fd4a2c02ab5a99b5420538c8b1bfef6f |
| sha1 | 746dc75b1b887812db37b3801e104d887b2c8707 | 0978b71ef79ff4df9fb90118cc2 Payload org.lfzfxjmb.securejp65 746dc75b1b887812db37b3801e104d887b2c8707 Payload net.yexqoe.systemlshkq c9258f527fe447431ff983aa7686 |
| sha1 | 8531fe2db41e9e08525080be6d3e8092c5ffa5f8 | 0460f53c9b49cb43a636bb721d28 Payload org.xrmhvlfx.litewnj3h 8531fe2db41e9e08525080be6d3e8092c5ffa5f8 Payload net.jsbzchba.clientpnzd 0d83344fee8973165e5009768c1 |
| sha1 | 8c696e368d45283872818492714dfea92728ae6f | s[.]com Not applicable Confirmed dropper net.hzzor.lite87n9 8c696e368d45283872818492714dfea92728ae6f Note: IP addresses and domains are intentionally Qdefanged |
| sha1 | 9e6889b1445e30d9d28849cbffed5a3123408646 | 7ecdb68c2222fc7af8e6f3b7d839 Payload org.fxutpep.utility0ql 9e6889b1445e30d9d28849cbffed5a3123408646 Payload net.rhnrektl.mobilejrs cca7187d5cbf31b3e785f21309bb |
| sha1 | ace41996dc5b7ecdb68c2222fc7af8e6f3b7d839 | 47431ff983aa76866e340db98e60 Payload net.mfiaekme.toolgdqvu ace41996dc5b7ecdb68c2222fc7af8e6f3b7d839 Payload org.fxutpep.utility0ql 9e6889b1445e30d9d28849cbffed |
| sha1 | b164a1bf2c7b478ce040e479377526c00885ab7f | 1036145b3e1b1d7e294b7a2f5ba26bd7f Payload io.nmflf.pro4d2ll b164a1bf2c7b478ce040e479377526c00885ab7f Network domain oscofneuid[.]com Not applicable Network doma |
| sha1 | b9e84889c9760460f53c9b49cb43a636bb721d28 | ype Package or indicator SHA-1 Payload net.wgrjvz.toolyt93a b9e84889c9760460f53c9b49cb43a636bb721d28 Payload org.xrmhvlfx.litewnj3h 8531fe2db41e9e08525080be6d3e |
| sha1 | c8f5abb80e9c936d6bd5da99c10e829cde69a8f5 | c11fc8e7f9a7caccfc9c54cb1ea3d Payload net.vsqomby.toolc4s1x c8f5abb80e9c936d6bd5da99c10e829cde69a8f5 Payload org.yhjrihi.managerrk9u6 20068b91036145b3e1b1d7e294 |
| sha1 | c9258f527fe447431ff983aa76866e340db98e60 | 7812db37b3801e104d887b2c8707 Payload net.yexqoe.systemlshkq c9258f527fe447431ff983aa76866e340db98e60 Payload net.mfiaekme.toolgdqvu ace41996dc5b7ecdb68c2222fc7a |
| sha1 | cca7187d5cbf31b3e785f21309bb60b9247a4fb4 | 30d9d28849cbffed5a3123408646 Payload net.rhnrektl.mobilejrs cca7187d5cbf31b3e785f21309bb60b9247a4fb4 Payload io.isvac.safemmz7g 562d8360854005e90ae316c1350b9660 |
| sha1 | d7b4d33c38deb0978b71ef79ff4df9fb90118cc2 | 52a25172123c2e7789c977e6bb557af Payload io.crxti.systems11f d7b4d33c38deb0978b71ef79ff4df9fb90118cc2 Payload org.lfzfxjmb.securejp65 746dc75b1b887812db37b3801e1 |
| sha1 | da997eeb64a3879af819c5cdda3aa5a236c55a25 | 854005e90ae316c1350b9660ffd3e6f9 Payload com.zjper.litewens da997eeb64a3879af819c5cdda3aa5a236c55a25 Payload org.pruvqil.appq1km 413e1c8661ec11fc8e7f9a7caccfc9c |
| sha1 | fd4a2c02ab5a99b5420538c8b1bfef6fa4fbd7fe | beb80ae1689dbbedcb53a86f85c8e44a Payload io.xccqt.helper3mk fd4a2c02ab5a99b5420538c8b1bfef6fa4fbd7fe Payload io.vvecxa.clientffb 2b5eeabbc52a25172123c2e7789c977 |
From the original article
4 min read at cybersecuritynews.com
An Android banking malware campaign is using advertisements inside streaming apps to turn everyday phones into tools for financial theft. Mirax, the malware abuses Accessibility Services to watch screens, capture passwords, intercept verification codes, and let criminals operate banking apps directly on infected devices. Thousands of Android phones belonging to retail banking customers across the […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.