Mirax Android RAT steals bank logins through streaming-app ads
Original title: Mirax Android RAT Hijacks Phones Through Streaming-App Ads to Steal Banking Credentials and Drain Accounts
Group-IB says thousands of phones in the Middle East, Turkey and Africa were infected from March to September 2026, with losses in the millions.
Group-IB says the Mirax remote-access trojan reached Android users through ads and video links in low-reputation Google Play streaming apps that sent them to outside installers, including one posing as “TikTok 18+.” After Accessibility access, Mirax reads screens, intercepts SMS and notifications, captures lock-screen secrets and operates banking apps. Overlays for more than 20 banking, wallet and crypto packages arrive from command-and-control after install. The campaign was still active when the November 5 report was published.
Unconfirmed: Loss totals cover only fraud visible to investigators and banks, and not every transfer’s route is established.
- Activity spiked around Eid and late July 2026, Group-IB reported.
- The payload impersonates Google Play Services using a Cyrillic letter resembling “o.”
- Two WebSocket channels split commands and stolen data, with HTTP long-polling as fallback.
- A SOCKS5 module can turn phones into residential proxies.
- Some proceeds may have moved through mule accounts in India; tracing continues.
Impact: Banking credentials, codes and account transfers stolen from phones
| Product | Affected |
|---|---|
| Google Android | — |
- 1.Reject unexpected Accessibility requests from entertainment apps and avoid advertised APK downloads.
- 2.Banks should review Accessibility abuse, remote control and screen sharing with transactions.
- 3.Seek removal help if a suspicious app blocks uninstallation.
- ATT&CK
- T1204.002 Malicious FileT1056.001 KeyloggingT1111 Multi-Factor Authentication InterceptionT1071.001 Web ProtocolsT1090.002 External Proxy
- Vendors
- Products
- AndroidGoogle Play
- Malware
- Mirax
- Organizations
- Group-IB
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | kenobuias.com | r type Value Network domain oscofneuid[.]com Network domain kenobuias[.]com Campaign build tag aquafina Campaign build-tag variant aq |
| domain | oscofneuid.com | 040e479377526c00885ab7f Indicator type Value Network domain oscofneuid[.]com Network domain kenobuias[.]com Campaign build tag aquafin |
| sha1 | 0d83344fee8973165e5009768c1752095a57f3c1 | e2db41e9e08525080be6d3e8092c5ffa5f8 net.jsbzchba.clientpnzd 0d83344fee8973165e5009768c1752095a57f3c1 org.xifbep.utilityt50 3a1f9060dad56cd08e87fcafa2c87b99295b3 |
| sha1 | 20068b91036145b3e1b1d7e294b7a2f5ba26bd7f | b80e9c936d6bd5da99c10e829cde69a8f5 org.yhjrihi.managerrk9u6 20068b91036145b3e1b1d7e294b7a2f5ba26bd7f io.nmflf.pro4d2ll b164a1bf2c7b478ce040e479377526c00885ab7f |
| sha1 | 2b5eeabbc52a25172123c2e7789c977e6bb557af | d4a2c02ab5a99b5420538c8b1bfef6fa4fbd7fe io.vvecxa.clientffb 2b5eeabbc52a25172123c2e7789c977e6bb557af io.crxti.systems11f d7b4d33c38deb0978b71ef79ff4df9fb90118cc |
| sha1 | 3a1f9060dad56cd08e87fcafa2c87b99295b3db3 | 3344fee8973165e5009768c1752095a57f3c1 org.xifbep.utilityt50 3a1f9060dad56cd08e87fcafa2c87b99295b3db3 io.svmlmt.mobilecu7sq 6a37c3d4beb80ae1689dbbedcb53a86f85c8e |
| sha1 | 413e1c8661ec11fc8e7f9a7caccfc9c54cb1ea3d | a997eeb64a3879af819c5cdda3aa5a236c55a25 org.pruvqil.appq1km 413e1c8661ec11fc8e7f9a7caccfc9c54cb1ea3d net.vsqomby.toolc4s1x c8f5abb80e9c936d6bd5da99c10e829cde69a |
| sha1 | 562d8360854005e90ae316c1350b9660ffd3e6f9 | cca7187d5cbf31b3e785f21309bb60b9247a4fb4 io.isvac.safemmz7g 562d8360854005e90ae316c1350b9660ffd3e6f9 com.zjper.litewens da997eeb64a3879af819c5cdda3aa5a236c55a25 |
| sha1 | 6a37c3d4beb80ae1689dbbedcb53a86f85c8e44a | f9060dad56cd08e87fcafa2c87b99295b3db3 io.svmlmt.mobilecu7sq 6a37c3d4beb80ae1689dbbedcb53a86f85c8e44a io.xccqt.helper3mk fd4a2c02ab5a99b5420538c8b1bfef6fa4fbd7fe |
| sha1 | 746dc75b1b887812db37b3801e104d887b2c8707 | 33c38deb0978b71ef79ff4df9fb90118cc2 org.lfzfxjmb.securejp65 746dc75b1b887812db37b3801e104d887b2c8707 net.yexqoe.systemlshkq c9258f527fe447431ff983aa76866e340db9 |
| sha1 | 8531fe2db41e9e08525080be6d3e8092c5ffa5f8 | 4889c9760460f53c9b49cb43a636bb721d28 org.xrmhvlfx.litewnj3h 8531fe2db41e9e08525080be6d3e8092c5ffa5f8 net.jsbzchba.clientpnzd 0d83344fee8973165e5009768c1752095a5 |
| sha1 | 9e6889b1445e30d9d28849cbffed5a3123408646 | 1996dc5b7ecdb68c2222fc7af8e6f3b7d839 org.fxutpep.utility0ql 9e6889b1445e30d9d28849cbffed5a3123408646 net.rhnrektl.mobilejrs cca7187d5cbf31b3e785f21309bb60b9247a |
| sha1 | ace41996dc5b7ecdb68c2222fc7af8e6f3b7d839 | 8f527fe447431ff983aa76866e340db98e60 net.mfiaekme.toolgdqvu ace41996dc5b7ecdb68c2222fc7af8e6f3b7d839 org.fxutpep.utility0ql 9e6889b1445e30d9d28849cbffed5a312340 |
| sha1 | b164a1bf2c7b478ce040e479377526c00885ab7f | 20068b91036145b3e1b1d7e294b7a2f5ba26bd7f io.nmflf.pro4d2ll b164a1bf2c7b478ce040e479377526c00885ab7f Indicator type Value Network domain oscofneuid[.]com Networ |
| sha1 | b9e84889c9760460f53c9b49cb43a636bb721d28 | compromise (IoCs):- Package name SHA-1 net.wgrjvz.toolyt93a b9e84889c9760460f53c9b49cb43a636bb721d28 org.xrmhvlfx.litewnj3h 8531fe2db41e9e08525080be6d3e8092c5ff |
| sha1 | c8f5abb80e9c936d6bd5da99c10e829cde69a8f5 | e1c8661ec11fc8e7f9a7caccfc9c54cb1ea3d net.vsqomby.toolc4s1x c8f5abb80e9c936d6bd5da99c10e829cde69a8f5 org.yhjrihi.managerrk9u6 20068b91036145b3e1b1d7e294b7a2f5ba |
| sha1 | c9258f527fe447431ff983aa76866e340db98e60 | c75b1b887812db37b3801e104d887b2c8707 net.yexqoe.systemlshkq c9258f527fe447431ff983aa76866e340db98e60 net.mfiaekme.toolgdqvu ace41996dc5b7ecdb68c2222fc7af8e6f3b7 |
| sha1 | cca7187d5cbf31b3e785f21309bb60b9247a4fb4 | 89b1445e30d9d28849cbffed5a3123408646 net.rhnrektl.mobilejrs cca7187d5cbf31b3e785f21309bb60b9247a4fb4 io.isvac.safemmz7g 562d8360854005e90ae316c1350b9660ffd3e6f9 |
| sha1 | d7b4d33c38deb0978b71ef79ff4df9fb90118cc2 | b5eeabbc52a25172123c2e7789c977e6bb557af io.crxti.systems11f d7b4d33c38deb0978b71ef79ff4df9fb90118cc2 org.lfzfxjmb.securejp65 746dc75b1b887812db37b3801e104d887b2 |
| sha1 | da997eeb64a3879af819c5cdda3aa5a236c55a25 | 562d8360854005e90ae316c1350b9660ffd3e6f9 com.zjper.litewens da997eeb64a3879af819c5cdda3aa5a236c55a25 org.pruvqil.appq1km 413e1c8661ec11fc8e7f9a7caccfc9c54cb1ea3 |
| sha1 | fd4a2c02ab5a99b5420538c8b1bfef6fa4fbd7fe | 6a37c3d4beb80ae1689dbbedcb53a86f85c8e44a io.xccqt.helper3mk fd4a2c02ab5a99b5420538c8b1bfef6fa4fbd7fe io.vvecxa.clientffb 2b5eeabbc52a25172123c2e7789c977e6bb557a |
From the original article
3 min read at cybersecuritynews.com
An Android banking malware campaign is turning streaming-app advertisements into a route for stealing credentials and draining accounts. Mirax, the remote access trojan lets criminals watch infected phones, intercept security codes, and operate banking apps directly from victims’ devices. Thousands of Android phones belonging to retail banking customers across the Middle East, Turkey, and Africa […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.