A newly uncovered Android threat dubbed “Mirax” has been siphoning off money from banking customers across the Middle East, Turkey, and Africa by disguising itself behind innocuous-seeming streaming-app ads. Operating since at least March 2026, the malware campaign has reportedly infiltrated thousands of devices and caused financial damage running into millions of dollars.
How Mirax infects devices and gains trust
Mirax begins its attack chain via low-reputation streaming apps available on Google Play. These apps display ads or video links that lure users to download a secondary installer—that one from outside the Play Store. One such installer lurks behind a fake “TikTok 18+” label (unrelated to ByteDance’s TikTok), and once run, delivers a payload that mimics Google Play Services. In this mimicry, it uses a visually confusing Cyrillic character that looks like the Latin “o,” helping conceal its true identity. Once installed, users are prompted to grant Accessibility privileges, which Mirax leverages to read screen contents and manipulate interfaces—opening the door to major compromise.
Exploiting banking apps, SMS, overlays and remote control
With Accessibility access secured, Mirax launches a multi-pronged attack: intercepting SMS and notifications, logging keystrokes, harvesting lock-screen PINs or patterns, and recording credentials through overlays that mimic genuine banking login screens. These features enable attackers to gain full control of banking apps, add new beneficiaries, authorize unauthorized transfers, and even take over devices entirely.
Because the fraud takes place through the victim’s real banking app and device, many conventional fraud detection tools—relying on device fingerprinting, IP reputation, or geographic signals—are much less effective. Malware authors have implemented features like encrypted DNS (DNS-over-HTTPS), remotely configurable command-and-control hosts, and fallback communication mechanisms to evade static detection.
Spread, scale and persistence
Between March and September 2026, Mirax had infected thousands of retail banking customers across Turkey, the Middle East, and Africa. The scale of monetary losses is likely far higher than confirmed cases, since many frauds go unreported or undetected. Notably, cases surged during Islamic holiday periods like Eid and in late July, consistent with social engineering success when users are more distracted or rushing to install entertainment apps.
Once installed, Mirax tries hard to stay under the radar. It hides its launcher icon, changes internal package names at random, re-appears after device reboots, blocks security apps, and displays fake update screens or black overlays while illicit activity runs in the background.
Targets, technical tricks, and indicators
The malware is programmed—via its remote infrastructure—to target over 20 banking and wallet-app packages, plus several cryptocurrency exchanges. It separates its core app from the configuration of overlays and mapping to specific apps. Multiple communication channels are used: WebSocket for commands, HTTP long-polling as a fallback. A SOCKS5 component lets operators repurpose compromised devices as residential proxies.
Researchers also identified specific package names and SHA-1 hashes linked to these malicious apps, as well as domains tied to the campaign. These indicators of compromise can help defenders and users detect possible infection. Some examples: “net.wgrjvz.toolyt93a” with SHA-1 “b9e84889c9760460f53c9b49cb43a636bb721d28”, and domain names like “oscofneuid[.]com” or “kenobuias[.]com”.
Defensive moves for users and banks
Security experts recommend that Android users avoid allowing Accessibility permissions for apps downloaded outside major app stores or for entertainment/streaming apps. Never install APKs prompted via ads unless their source is verified. If an app refuses to uninstall, shows fake update messages, or obstructs uninstall screens, it could be malicious.
For banks, combining behavioral detection—such as monitoring for screen sharing or accessibility abuse—with transaction heuristics (multiple internal transfers, unusual beneficiary additions) can help flag fraud earlier. Delaying payments for manual verification during suspicious activity, especially from devices that suddenly show new app overlays or remote control behavior, may reduce losses.
Mirax is more than just another Android banking trojan. Its use of streaming-app ads for delivery, plus its stealthy overlay attacks, Accessibility exploitation, and multi-channel communication make it unusually sophisticated. The campaign’s timing—spiking during holidays—and large geographic spread suggest both careful planning and wide reach. Moving forward, defenders should keep sharpening detection of abuse of system services, review permissions granted to casual entertainment apps, and enhance fraud monitoring with signals beyond traditional device fingerprints. The real test will be whether Mirax becomes a blueprint for future RATs or remains an advanced but isolated case needing tailored response.
