CYBERSECURITY researchers have uncovered six Android malware families designed to steal data and carry out financial fraud, including PixRevolution, TaxiSpy RAT, BeatBanker, Mirax, Oblivion RAT, and SURXRAT. PixRevolution, according to Zimperium, targets Brazil’s Pix instant payments by hijacking transfers in real time and routing funds to the attackers; the malware uses fake Google Play Store listings and requests accessibility service to operate.
BeatBanker, described by Kaspersky, pursues cryptocurrency-related fraud via overlays on wallets such as Binance and Trust Wallet and can drop a cryptocurrency miner alongside banking Trojan functionality. TaxiSpy RAT, with evasion claims from CYFIRMA, combines desktop-like surveillance with full remote access, stealing SMS messages, contacts, call logs and more while monitoring for targeted banking and crypto apps.
Mirax is offered as MaaS, with a monthly price for a full version or a lighter variant, offering overlays, keystrokes, and a SOCKS5 proxy, while Oblivion markets automated permission bypass and deep persistence via a MaaS model. SURXRAT, marketed on Telegram, integrates an LLM component in some samples and can display ransomware-style screen lockers to force payments, according to Cyble.