Mirax Android RAT: Server-side Device Takeover Targeting META Banking Customers via Malicious Ads in Streaming Apps

Key facts for Mirax server-side Android RAT

Detection coverage for Mirax server-side Android RAT

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5306 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Mirax Android RAT - 'Google Play Services' Cyrillic Homoglyph Masquerade (T1655.001)

Detects Android apps labelled 'Google Play Services' (including the Cyrillic 'o' homoglyph variant reported by Group-IB for Mirax / MiraxBot, build tag aquafina) whose package is not the genuine com.google.android.gms. Mirax impersonates Google Play Services, generates a fresh package name per build (e.g. net.wgrjvz.toolyt93a) and then requests the Accessibility Service (T1453) for full device takeover. Behaviour-first: fires on the masquerade, not on rotating hashes or package names.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1655.001, T1453
• Data sources: mtd:android:app_inventory, DeviceTvmSoftwareInventory, android mtd app inventory
• Severity: high
• Confidence: high

Splunk SPL

index=mobile sourcetype="mtd:android:app_inventory" earliest=-24h
| where match(app_name, "(?i)^G[oOоО]{2}gle +Play +Services$")
| where package_name!="com.google.android.gms"
| eval spoof_type=if(app_name=replace(app_name,"[^ -~]",""),"ascii_name_spoof","cyrillic_homoglyph")
| stats earliest(_time) as first_seen latest(_time) as last_seen values(spoof_type) as spoof_type values(accessibility_enabled) as accessibility_enabled by device_id, user, app_name, package_name
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

// DeviceTvmSoftwareInventory is a snapshot table (no Timestamp); schedule the rule daily
DeviceTvmSoftwareInventory
| where OSPlatform =~ 'Android'
| where SoftwareName matches regex '(?i)^G[oOоО]{2}gle +Play +Services$'
| where not(SoftwareVendor =~ 'google' and SoftwareName matches regex '^[ -~]+$')
| project DeviceId, DeviceName, SoftwareVendor, SoftwareName, SoftwareVersion, OSVersion

Sigma

title: Mirax Android RAT Google Play Services Homoglyph Masquerade
id: 3f6c1a52-8d47-4b9e-a1c3-5e2b7d90f101
status: experimental
description: Detects an Android app labelled 'Google Play Services' (including the Cyrillic 'o' homoglyph variant) installed under a package other than com.google.android.gms, as used by the Mirax Android RAT (MiraxBot, build tag aquafina).
references:
  - https://www.group-ib.com/blog/mirax-android-device-takeover-rat/
  - https://www.cleafy.com/cleafy-labs/mirax-a-new-android-rat-turning-infected-devices-into-potential-residential-proxy-nodes
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.defense-evasion
  - attack.t1655.001
  - attack.credential-access
  - attack.t1453
logsource:
  product: android
  service: mtd
detection:
  selection:
    app_name|re: '(?i)^G[oOоО]{2}gle +Play +Services$'
  filter_genuine:
    package_name: 'com.google.android.gms'
  condition: selection and not filter_genuine
falsepositives:
  - Internal test builds or OEM forks that deliberately reuse the Google Play Services label
level: high

Known false positives:

• Enterprise-signed internal apps or OEM forks that reuse the Google Play Services display name
• Test devices running custom ROMs with a renamed GMS package

Tuning notes: Index/sourcetype assume a mobile threat defense or MDM app-inventory feed normalised to app_name, package_name, device_id, user; map to your feed's field names. Allowlist OEM GMS forks by package name. Pivot hits to accessibility_enabled=true as highest priority.

• 🔒 Mirax Android RAT - Known APK Sample Hash or Package Match (T1660) · unlock with TL Creds
• 🔒 Mirax Android RAT - Accessibility-Driven Uninstall and Security App Blocking with Boot Persistence (T1629.001, T1629.003, T1624.001) · unlock with TL Creds
• 🔒 Mirax Android RAT - C2 Domains and Residential Proxy Fan-out (T1437.001, T1604, T1646) · unlock with TL Creds
• 🔒 Mirax Android RAT - Dropper Delivery Domain DNS Lookup (T1660) · unlock with TL Creds
• 🔒 Mirax Android RAT - Hidden Launcher Icon with Accessibility and Boot Receiver (T1453, T1624.001, T1655.001) · unlock with TL Creds
• 🔒 Mirax Android RAT - Yamux WebSocket C2 Endpoints /control /data /tunnel on Ports 8443-8445 (T1437.001, T1646) · unlock with TL Creds
• 🔒 Mirax Android RAT - Non-System App Granted Accessibility, SMS, Overlay and Boot Permissions (T1453, T1517, T1636.004, T1624.001) · unlock with TL Creds
• 🔒 Mirax Android RAT - C2 Domain Resolution or Proxy Access ([indicator], [indicator], [indicator]) (T1437.001) · unlock with TL Creds

Indicators of compromise for Mirax server-side Android RAT

As of 2026-11-05, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-5306.

Sample indicators (3 of 29)

• Domain: oscofneuid[.]com
• File hash: b9e84889c9760460f53c9b49cb43a636bb721d28
• Domain: kenobuias[.]com

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

How Mirax server-side Android RAT works

Mirax is an Android remote access trojan advertised since 19 December 2025 on underground forums as a 'private' MaaS reserved for vetted affiliates, with priority given to established Russian-speaking actors (Group-IB, Cleafy). Group-IB (published 2026-11-05) documents a campaign observed March to September 2026 against retail banking customers in the META region (Middle East, Turkey, Africa), with spikes during Eid holidays and late July 2026. Group-IB reports confirmed losses in the millions of USD and says the true figure is likely higher. The campaign is tied together by an 'aquafina' / 'aquafina_all' build tag.

Infection chain: victims are shown malicious ads inside free, low-reputation video streaming apps on Google Play. The ads redirect to external droppers, one of which is a fake NSFW app called 'TikTok 18+' (no ByteDance affiliation). The dropper downloads and installs the Mirax second stage. The payload impersonates 'Google Play Services' using a Cyrillic homoglyph (Cyrillic 'o' in place of Latin 'o'), generates a new package name for every build, rotates its visible app name, and hides its launcher icon at runtime. The Accessibility Service is the single permission that unlocks full remote control. Once granted, the malware abuses it for self-preservation: blocking the uninstall screens, blocking security app launches and app closure, and re-establishing itself after reboot through Android Broadcast Receivers.

Capabilities: Group-IB documents 100+ commands, including interactive screen sharing/VNC, gesture injection (tap, swipe), capture and replay of the lock-screen PIN, password or pattern, remote unlock with the screen off, a full-screen black overlay (including a fake 'updating' screen) to hide fraud, keylogging, clipboard read/modify, camera access, SMS and notification interception for OTP theft, application launcher/blocker, and device state and installed-app inventory reporting. HTML overlay injection targets banking, crypto, email and social apps. Phishing templates and app-to-template mappings are pushed from the C2 after installation and are not present in the APK. About 20+ META banks and digital wallets and two global crypto exchanges are targeted. In February 2026 the developer added a SOCKS5 module that turns infected phones into residential proxy nodes, so fraudulent traffic comes from the victim's own IP and passes geolocation and reputation checks.

C2 design: a dual-WebSocket architecture over a single host, with an HTTP long-poll fallback and DNS-over-HTTPS enabled by default, which keeps C2 resolution invisible to local and carrier DNS. Nearly all transport parameters can be reconfigured remotely. Group-IB lists the C2 domains oscofneuid[.]com and kenobuias[.]com and 19 SHA1 hashes (samples installed June-August 2026). Monetization evidence includes suspected mule accounts in India and international transfers, account-to-account transfers and eShop purchases.

Separate reporting by Cleafy (published about 2026-10-04, first spotted early March 2026 by Outpost24 KrakenLabs) describes the same family in a Spanish-speaking campaign: Meta ads (Facebook, Instagram, Messenger, Threads) leading to phishing IPTV/sports-streaming sites, droppers on GitHub Releases with daily hash rotation, Virbox and Golden Crypt packers, RC4/XOR payload protection, WebSocket C2 with a custom Yamux implementation on ports 8443-8445 (/control, /data, /tunnel), 182+ targeted banking/crypto apps, and reported pricing of $2,500 per three months. That Cleafy campaign is a distinct operation from the Group-IB META campaign, and its infrastructure is recorded here only as family-level IOCs. Note that Group-IB's 'META' means Middle East, Turkey and Africa, not Meta Platforms. No CVE is involved; infection relies on social engineering and abuse of the Accessibility Service.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1406.002 Obfuscated Files or Information: Software Packing; T1629.001 Impair Defenses: Prevent Application Removal; T1629.003 Impair Defenses: Disable or Modify Tools; T1655.001 Masquerading: Match Legitimate Name or Location

Credential Access

T1417.001 Input Capture: Keylogging; T1417.002 Input Capture: GUI Input Capture; T1453 Abuse Accessibility Features

Discovery

T1418 Software Discovery; T1422 System Network Configuration Discovery

Command and Control

T1437.001 Application Layer Protocol: Web Protocols

Collection

T1512 Video Capture; T1513 Screen Capture; T1517 Access Notifications; T1636.004 Protected User Data: SMS Messages

defense-evasion

T1604 Proxy Through Victim

Persistence

T1624.001 Event Triggered Execution: Broadcast Receivers

Exfiltration

T1646 Exfiltration Over C2 Channel

Initial Access

T1660 Phishing

Remediation for Mirax server-side Android RAT

Immediate actions

• Block and alert on the Group-IB C2 domains oscofneuid.com and kenobuias.com (and the Cleafy-reported ilovepng.info and descarga-smtr.net) at DNS, proxy and egress
• Flag banking sessions that show remote-control or screen-sharing indicators alongside an active transaction as high priority and hold the transaction pending customer verification
• Add confirmed-affected devices to enhanced monitoring lists and contact affected customers directly
• Hunt managed Android fleets for the 19 SHA1 hashes and for apps using the 'Google Play Services' name with a Cyrillic homoglyph

Workarounds

• Users should avoid ads, video pop-ups and redirects in untrusted streaming apps and sites
• Treat any Accessibility Service request from a streaming or entertainment app as a red flag; decline it and uninstall the app

Longer-term hardening

• Monitor for post-install Accessibility Service and device admin grants to non-accessibility apps, and for dual-WebSocket and DoH network signatures
• Block sideloading of apps from untrusted sources and enforce Play Protect on managed devices
• Track expansion of the overlay phishing template set and keep certificate, package and C2 indicator lists current
• Share indicators with peer institutions and app-store abuse teams where legally permitted

Affected and fixed versions

• Google — Android
  Vulnerable versions: Devices that allow sideloading and grant Accessibility Service permission to the malicious app

Timeline of Mirax server-side Android RAT

• 2025-12-19 locked-ioc-29 first promoted as a private MaaS on underground Russian-language forums by the developer handle MiraxBot (Cleafy; Group-IB places availability from December 2025)
• 2026-02-01 SOCKS5 residential proxy module added to locked-ioc-29 (February 2026, exact day not stated), turning infected phones into proxy nodes
• 2026-03-01 Early March 2026: Outpost24 KrakenLabs first spots locked-ioc-29 and Cleafy begins active monitoring of the Spanish-language Meta-ads campaign; Group-IB campaign observation window starts
• 2026-06-01 Group-IB's 19 documented META-region samples begin installing on victim devices (June-August 2026, per-sample dates not stated)
• 2026-07-25 Activity spike in late July 2026 against META retail banking customers (day approximate); an earlier spike coincided with the Eid holidays
• 2026-10-04 Cleafy publishes its analysis of locked-ioc-29: Meta-ad distribution, GitHub-hosted droppers, Yamux-over-WebSocket C2 and SOCKS5 proxying, with 200,000+ accounts reached
• 2026-11-05 Group-IB publishes 'From Streaming to Stealing', documenting locked-ioc-29 server-side device takeover against META banking customers with confirmed losses in the millions of USD

Sources cited for Mirax server-side Android RAT

• From Streaming to Stealing: Mirax and the Rise of Server-side Android Device Takeover in META group-ib.com · Research · 2026-11-05
• Mirax: a new Android RAT turning infected devices into potential residential proxy nodes (Cleafy Labs) cleafy.com · Research · 2026-10-04
• Mirax RAT expands mobile banking and surveillance threats (Zimperium) zimperium.com · Vendor report
• Mirax Android RAT: Defending against Meta ad campaigns and SOCKS5 proxy abuse (Security Arsenal) securityarsenal.com · Blog
• Mirax malware campaign hits 220K accounts, enables full remote control (Security Affairs) securityaffairs.com · News
• Mirax RAT Targets Android Devices Through Meta Apps (BankInfoSecurity) bankinfosecurity.com · News

More in malware

• HEAVYGRAM: Telegram-based Surveillance Backdoor Linked to Handala Hack (Void Manticore / MOIS)
• Phexia macOS Malware Delivered via ClickFix, Using Polygon Smart Contracts (EtherHiding) for C2
• Multi-Stage Windows PowerShell Loader Chain Delivering Themida/UPX-Protected Native Payload (contis.exe) with In-Memory Cryptographic Reconstruction
• China-Aligned SlippyNunchucks Hijacks Sogou Input Method DNS Requests to Deploy DarkVigil (FDMTP) Backdoor (CVE-2026-120422)
• XLoader (FormBook) Infostealer Delivered via Fake Business Order Phishing, RAR/JScript/LuaJIT Chain with In-Memory Injection