Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehighExploited in the wild

Mirax Android trojan infects thousands via fake streaming apps

2 sources · 2 articlesFirst reported Updated ()2
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Group-IB says Mirax infected thousands of phones in the Middle East, Turkey and Africa from March to September 2026 and was still active.

Group-IB says the Mirax Android remote-access trojan reached users through ads and video links in low-reputation Google Play streaming apps that redirected them to outside installers, including one posing as “TikTok 18+.” After Accessibility access, it can read screens, intercept SMS and notifications, capture lock-screen secrets, and operate banking apps, with overlays for more than 20 banking, wallet and crypto packages delivered from command-and-control. Infections affected thousands of users across the Middle East, Turkey and Africa from March to September 2026; Group-IB puts losses in the millions. A 2026 SOCKS5 module can turn phones into residential proxies. The campaign was still active when Group-IB’s November 5 report was published; the firm identified infrastructure and recommended transaction verification.

Key facts
  • Thousands of infections from March through September 2026 in META.
  • Overlays target more than 20 banking, wallet and crypto apps.
  • Payload impersonates Google Play Services using a Cyrillic lookalike “o.”
  • Two WebSocket channels, with HTTP long-polling as fallback.
  • Group-IB says some proceeds may have moved via Indian mule accounts.
  • Activity spiked around Eid and late July 2026, Group-IB reported.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 5, 2026Group-IB report finds Mirax campaign still active · Cyber Security News

What each outlet adds

beyond the shared facts
  • Cyber Security NewsLosses in the millions, TikTok 18+ lure, WebSocket C2 and India mule tracing
  • GBHackersGroup-IB identified C2 and advised transaction verification
Vendors
Google
Products
AndroidGoogle Play
Malware
Mirax
Victims
retail banking customers in META region
Organizations
Group-IB
Countries
TurkeyIndia

Coverage

oldest first · one row per article · UTC
  1. · 3d ago GBHackersFirst report

    Mirax Android malware spreads via fake streaming apps

    Mirax banking trojan steals credentials through accessibility abuse and remote control in infections across META region.

  2. · 3d ago Cyber Security News

    Mirax Android RAT steals bank logins through streaming-app ads

    Group-IB says thousands of phones in the Middle East, Turkey and Africa were infected from March to September 2026, with losses in the millions.