Mirax Android malware steals bank funds via accessibility services
Group-IB says thousands of retail banking phones in the Middle East, Türkiye and Africa were infected from March to September 2026.
Stories per day · 30 days
1 RSS
Relatedandroid3accessibility-abuse2ghostbat2india2smishing2upi2accessibility-services1cyble1dll-side-loading1lampion1mirax1mobile-malware1overlay1overlord-rat1vlc1vmware1
14 stories, newest first · one card per story
Stories tagged #banking-malware
VLC and VMware binaries side-load malware targeting Brazil and Portugal
WatchGuard linked the activity to Overlord RAT, Lampion, and a Pascal remote-access payload, without one shared operator.
1
New GhostBat Android Malware Targets 60 Banking and UPI Apps to Steal PINs
GhostBat Android malware steals UPI PINs from 60 Indian banking apps using accessibility overlays and transparent keypads.
Hackers Target 60 Indian Banking and UPI Apps With New GhostBat Android Malware
GhostBat Android malware targets 60 Indian banking and UPI apps, capturing PINs via Accessibility overlays.
⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
Weekly recap led by actively exploited Cisco ISE auth-bypass CVE-2026-76460 (CVSS 10.0), plus Plugin4Shell AI-agent RCE and KREMLIN banking malware.
RatHat Android Trojan Uses AI for Automation
Zimperium says RatHat, an Android trojan, uses generative AI to control devices and steal banking credentials.
RatHat Abuses Android Wireless Debugging to Gain Shell Access and Steal Banking PINs
New Android banking trojan RatHat abuses Wireless Debugging to gain shell access and steals banking PINs and OTPs via raw touch capture.
3
Malware bypasses browser checks to force install Chrome, Edge extensions
Elastic Security Labs detailed KREMLIN, a Brazilian banking malware that silently installs malicious Chrome and Edge extensions, with 1,515 confirmed infections.
3
KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension
Elastic tracks KREMLIN banking malware that used fake Brazilian bank JavaScript lures to deploy malicious Chrome and Edge extensions on 1,515 systems.
1
KREMLIN Banking Malware Bypasses Chrome Security to Steal Banking Sessions
Elastic Security Labs details KREMLIN, a Brazilian banking malware that implants malicious Chrome and Edge extensions by forging Chromium integrity values to steal banking sessions.
1
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens
Elastic Security Labs details KREMLIN, Brazilian banking malware using malicious Chrome/Edge extensions and Ethereum smart contracts to steal credentials and session tokens.
2
The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions
Elastic details KREMLIN, a Brazilian banking malware whose malicious Chrome/Edge extension forges Chromium integrity checks to steal sessions.
2
Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices
ThreatFabric identified Manic, an Android banking malware and spyware targeting Ukrainian and European financial apps with novel offline Wi-Fi mesh data exfiltration via nearby infected devices.
6
Manic: The Android Malware That Exfiltrates Data Even When the Phone Is Offline
ThreatFabric identifies Manic, an Android banking fraud and spyware platform targeting Ukraine with offline Bluetooth/Wi-Fi Direct mesh exfiltration and device takeover.
3