A sophisticated Android malware campaign dubbed Mirax has been uncovered, targeting banking customers across the Middle East, Türkiye, and Africa. Operating since at least March 2026, Mirax is focused on stealing funds by controlling users’ phones through a mix of accessibility abuse, screen capture, SMS interception, and banking overlays. The losses are believed to run into the millions of dollars, though exact figures remain elusive.
How Mirax Infects Devices
The infection often starts with low-quality streaming apps available on the Google Play Store, which push ads or video links leading users to install a secondary payload outside of the official store. One installer disguised itself as “TikTok 18+”, an entirely fake version unrelated to the real TikTok platform. After side-loading, the payload masquerades as Google Play Services—using visual tricks like substituting Cyrillic characters for Latin ones to evade detection.
A crucial goal of the malware is to trick users into giving Accessibility Service permissions. Rather than a simple prompt, Mirax walks infected users through granting those settings. Once activated, it gains the capability to see what’s on screen and take actions like opening banking apps, adding recipients, transferring money—all without visible user input. In parallel, it gathers credentials via keylogging, intercepts SMS messages, monitors notifications, and even captures unlock PINs or patterns.
Command-and-Control & Attack Flexibility
Mirax keeps most of its configuration off the device, sourcing overlays, targeted app mappings, and server settings from its command-and-control infrastructure. This allows attackers to switch targets or change tactics without updating the malicious APK. In total, more than 20 banking and wallet apps and several crypto exchange apps have been identified as victims. The overlays mimic legitimate login screens to harvest credentials in a convincing fashion.
The malware uses two separate WebSocket channels: one dedicated to commands, another for exfiltrating stolen data. As a fallback, it also uses HTTP long-polling. For added stealth, DNS-over-HTTPS is turned on, making domain lookups harder to trace. The installation icon is hidden, package names randomized, and broadcast receivers restore functionality after reboots. Victims may see fake update screens or black overlays designed to mask the malicious activity, and uninstall prompts or security tools can be blocked.
Scope, Financial Effects, and Indicators
Between March and September 2026, thousands of Android devices have been affected, exposing retail banking customers to significant fraud. While exact losses are unknown, banks and investigators confirmed multiple cases totaling millions in USD for those incidents visible to law enforcement. Activity surged during events like Eid and around late July. Operators have also used mule accounts—some traced to India—to move stolen funds. However, complete tracing has been challenging.
Several indicators of compromise (IoCs) are available, including numerous package names with associated SHA-1 hashes tied to payloads, as well as domains linked to the communications infrastructure. These include packages such as “net.wgrjvz.toolyt93a”, “org.xrmhvlfx.litewnj3h”, among others, and domains like “oscofneuid[.]com” and “kenobuias[.]com”. Investigation and reporting suggest this is just a baseline view—more victims and compromised victims may yet be uncovered.
Recommendations for Defense
Banks are advised to monitor for signs such as unexpected Accessibility usage, behaviors characteristic of screen sharing or remote control, and anomalous transactions. Relying on file signatures alone is insufficient, as Mirax uses server-driven overlays and rapidly changing indicators. Users should avoid installing apps promoted through shady advertisements, decline unexpected Accessibility requests—especially from entertainment apps—and steer clear of installing anything from unofficial sources.
Mirax is a stark reminder of how Android’s powerful Accessibility features, meant for assisting users, can be misused. What’s especially worrying is how Mirax operates like the genuine device owner during fraud—making detection more difficult. Going forward, Android security policies—particularly around permissions—need to sharpen guardrails against abuse. All stakeholders from Google to financial institutions must step up monitoring, awareness, and response mechanisms to curb this threat. What to watch next: how regulators respond, whether Google tightens Play Store vetting, and how quickly perimeter defenses like fraud detection systems adapt to this latest wave of deep-access attacks.
