Mirax Android RAT steals banking credentials across META region

Between March and September 2026, Group-IB confirmed thousands of Android devices in the META region were infected with Mirax, an Android device takeover (DTO) RAT sold as private malware-as-a-service. Operators used theMirax tool to drive victims’ banking apps in real time, with losses estimated in the millions of US dollars. The campaign targeted retail banking customers across more than 20 banks and digital wallets in the region and was described by Group-IB as still active at the time of reporting.

Delivery begins with a free video-streaming app from Google Play; however, evidence suggests the app’s advertising banners funnel users to a dropper downloaded off the official store. A confirmed dropper masqueraded as an adult version of TikTok, though it has no link to the real TikTok. Infections spiked around the Eid holidays and again at the end of July. The Mirax payload impersonates “Google Play Services” and even swaps a Latin letter for a Cyrillic one in the name.

Victims are guided to enable the Accessibility Service, which enables full device takeover: Mirax can read screens, intercept SMS codes, tap through apps, capture PINs, passwords or patterns, and replay them to unlock the device when unattended.

Mirax communicates with two WebSocket channels for commands and stolen data, with an HTTP long-poll fallback, and can be remotely reconfigured on various parameters including ports, TLS and polling intervals. A February 2026 update added a SOCKS5 module, turning infected devices into residential proxies.

The developer handle behind MiraxBot has been active on Russian-language crime forums since December 2025, with samples carrying the build tag “aquafina.” Group-IB notes that detection tied only to a single sample is likely to lag behind the campaign’s real-world activity.