New Mirax Android Malware Uses Accessibility Services to Remotely Control Phones and Steal Bank Funds

An Android banking malware campaign is using advertisements inside streaming apps to turn everyday phones into tools for financial theft.

Mirax, the malware abuses Accessibility Services to watch screens, capture passwords, intercept verification codes, and let criminals operate banking apps directly on infected devices.

Thousands of Android phones belonging to retail banking customers across the Middle East, Türkiye, and Africa were confirmed infected between March and September 2026.

Reported fraud cases point to losses reaching millions of US dollars, although the confirmed figures cover only infections and transactions visible to investigators and affected banks.

Researchers from Group-IB identified the campaign in a technical investigation published November 5, noting sharp increases in activity around Eid and late July.

The operation remained active when the report appeared, with its operators changing application names and infrastructure to complicate detection.

New Mirax Android Malware Uses Accessibility Services

Evidence suggests the infection begins with advertisements or video links inside low-reputation streaming apps available through Google Play. Those links direct users to a separate installer outside the official store.

Similar fake streaming app campaigns have used entertainment offers to persuade victims to install remote-control malware and approve dangerous permissions.

One confirmed Mirax installer pretended to be “TikTok 18+,” an imitation unrelated to TikTok or ByteDance. It retrieved the second-stage payload, which disguised itself as Google Play Services.

Its displayed name substituted a Cyrillic “о” for the Latin letter, making the fraudulent system component harder to distinguish at a glance.

The crucial step is persuading victims to enable Accessibility access. Mirax actively guides users toward granting this permission rather than simply displaying a request.

Once enabled, the malware can observe the interface and perform actions on the victim’s behalf, giving operators an interactive route into banking sessions.

Mirax combines that access with keylogging, SMS interception, notification collection, and screen monitoring. It can capture a phone’s unlock PIN, password, or pattern and replay the stolen secret later.

Operators can therefore unlock unattended devices, open banking apps, add beneficiaries, and initiate transfers while the owner is not watching.

This makes the fraud difficult to separate from legitimate activity. Transactions originate from the customer’s actual phone and banking application, rather than an unfamiliar device.

Earlier reporting on Mirax residential proxy capabilities also described how compromised phones can relay traffic, allowing attackers to use victims’ genuine internet addresses.

Investigators documented international transfers and evidence suggesting mule accounts in India helped move stolen funds.

However, tracing remained ongoing, and the report does not establish the final destination of every payment. Its loss estimate is a confirmed baseline, not a complete accounting of the campaign.

Server-Controlled Targets Complicate Detection and Response

Mirax keeps important attack settings outside its Android installation package. Its command-and-control server supplies banking overlay templates and mappings that determine which installed applications to target.

Those overlays imitate legitimate interfaces to collect credentials, while server-side updates let operators change targets without distributing another malware build.

The campaign targeted more than 20 banking and wallet application packages, alongside some global cryptocurrency exchanges. This configurable approach differs from malware carrying every phishing screen inside its installer.

Related Android banking overlay attacks show how convincing imitation interfaces can turn an apparently normal login into credential theft.

Communication uses two persistent WebSocket channels: one for commands and another for stolen data. An HTTP long-polling fallback provides another communication path.

Operators can remotely change hosts, ports, encryption settings, and polling intervals. DNS-over-HTTPS, enabled by default, also reduces visibility into domain lookups through conventional local DNS monitoring.

The malware hides its launcher icon, randomizes package names, and restores activity through Android broadcast receivers after reboots or application restarts.

It can block uninstall screens and security applications, while black overlays or a fake updating screen conceal malicious activity from the victim.

For banks, Group-IB recommends correlating transaction attempts with Accessibility abuse, screen sharing, and remote-control signals rather than relying on file signatures alone.

Suspicious payments should receive priority review and customer verification. Users should reject unexpected Accessibility requests from entertainment apps and avoid installers promoted through untrusted advertisements.

Indicators of compromise (IoCs):-

Type	Package or indicator	SHA-1
Payload	net.wgrjvz.toolyt93a	b9e84889c9760460f53c9b49cb43a636bb721d28
Payload	org.xrmhvlfx.litewnj3h	8531fe2db41e9e08525080be6d3e8092c5ffa5f8
Payload	net.jsbzchba.clientpnzd	0d83344fee8973165e5009768c1752095a57f3c1
Payload	org.xifbep.utilityt50	3a1f9060dad56cd08e87fcafa2c87b99295b3db3
Payload	io.svmlmt.mobilecu7sq	6a37c3d4beb80ae1689dbbedcb53a86f85c8e44a
Payload	io.xccqt.helper3mk	fd4a2c02ab5a99b5420538c8b1bfef6fa4fbd7fe
Payload	io.vvecxa.clientffb	2b5eeabbc52a25172123c2e7789c977e6bb557af
Payload	io.crxti.systems11f	d7b4d33c38deb0978b71ef79ff4df9fb90118cc2
Payload	org.lfzfxjmb.securejp65	746dc75b1b887812db37b3801e104d887b2c8707
Payload	net.yexqoe.systemlshkq	c9258f527fe447431ff983aa76866e340db98e60
Payload	net.mfiaekme.toolgdqvu	ace41996dc5b7ecdb68c2222fc7af8e6f3b7d839
Payload	org.fxutpep.utility0ql	9e6889b1445e30d9d28849cbffed5a3123408646
Payload	net.rhnrektl.mobilejrs	cca7187d5cbf31b3e785f21309bb60b9247a4fb4
Payload	io.isvac.safemmz7g	562d8360854005e90ae316c1350b9660ffd3e6f9
Payload	com.zjper.litewens	da997eeb64a3879af819c5cdda3aa5a236c55a25
Payload	org.pruvqil.appq1km	413e1c8661ec11fc8e7f9a7caccfc9c54cb1ea3d
Payload	net.vsqomby.toolc4s1x	c8f5abb80e9c936d6bd5da99c10e829cde69a8f5
Payload	org.yhjrihi.managerrk9u6	20068b91036145b3e1b1d7e294b7a2f5ba26bd7f
Payload	io.nmflf.pro4d2ll	b164a1bf2c7b478ce040e479377526c00885ab7f
Network domain	oscofneuid[.]com	Not applicable
Network domain	kenobuias[.]com	Not applicable
Confirmed dropper	net.hzzor.lite87n9	8c696e368d45283872818492714dfea92728ae6f

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post New Mirax Android Malware Uses Accessibility Services to Remotely Control Phones and Steal Bank Funds appeared first on Cyber Security News.