# Mirax Android RAT: Server-side Device Takeover Targeting META Banking Customers via Malicious Ads in Streaming Apps

> Mirax is an Android RAT sold as a private malware-as-a-service by the developer handle 'MiraxBot' on Russian-language cybercrime forums since December 2025. Group-IB reports it is delivered through malicious ads in low-reputation streaming apps on Google Play that lead to external droppers (one impersonating 'TikTok 18+') and targets retail banking customers in the Middle East, Turkey and Africa (META) with overlay injection, OTP interception, VNC-style screen control and a SOCKS5 residential proxy module.

- **Published:** 2026-11-05T07:36:51Z
- **Last reviewed:** 2026-11-05T07:36:51Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5306
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5306.png
- **ID:** TL-2026-5306
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** MiraxBot
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (3 shown free below)

## Description

Mirax is an Android remote access trojan advertised since 19 December 2025 on underground forums as a 'private' MaaS reserved for vetted affiliates, with priority given to established Russian-speaking actors (Group-IB, Cleafy). Group-IB (published 2026-11-05) documents a campaign observed March to September 2026 against retail banking customers in the META region (Middle East, Turkey, Africa), with spikes during Eid holidays and late July 2026. Group-IB reports confirmed losses in the millions of USD and says the true figure is likely higher. The campaign is tied together by an 'aquafina' / 'aquafina_all' build tag.

Infection chain: victims are shown malicious ads inside free, low-reputation video streaming apps on Google Play. The ads redirect to external droppers, one of which is a fake NSFW app called 'TikTok 18+' (no ByteDance affiliation). The dropper downloads and installs the Mirax second stage. The payload impersonates 'Google Play Services' using a Cyrillic homoglyph (Cyrillic 'o' in place of Latin 'o'), generates a new package name for every build, rotates its visible app name, and hides its launcher icon at runtime. The Accessibility Service is the single permission that unlocks full remote control. Once granted, the malware abuses it for self-preservation: blocking the uninstall screens, blocking security app launches and app closure, and re-establishing itself after reboot through Android Broadcast Receivers.

Capabilities: Group-IB documents 100+ commands, including interactive screen sharing/VNC, gesture injection (tap, swipe), capture and replay of the lock-screen PIN, password or pattern, remote unlock with the screen off, a full-screen black overlay (including a fake 'updating' screen) to hide fraud, keylogging, clipboard read/modify, camera access, SMS and notification interception for OTP theft, application launcher/blocker, and device state and installed-app inventory reporting. HTML overlay injection targets banking, crypto, email and social apps. Phishing templates and app-to-template mappings are pushed from the C2 after installation and are not present in the APK. About 20+ META banks and digital wallets and two global crypto exchanges are targeted. In February 2026 the developer added a SOCKS5 module that turns infected phones into residential proxy nodes, so fraudulent traffic comes from the victim's own IP and passes geolocation and reputation checks.

C2 design: a dual-WebSocket architecture over a single host, with an HTTP long-poll fallback and DNS-over-HTTPS enabled by default, which keeps C2 resolution invisible to local and carrier DNS. Nearly all transport parameters can be reconfigured remotely. Group-IB lists the C2 domains oscofneuid[.]com and kenobuias[.]com and 19 SHA1 hashes (samples installed June-August 2026). Monetization evidence includes suspected mule accounts in India and international transfers, account-to-account transfers and eShop purchases.

Separate reporting by Cleafy (published about 2026-10-04, first spotted early March 2026 by Outpost24 KrakenLabs) describes the same family in a Spanish-speaking campaign: Meta ads (Facebook, Instagram, Messenger, Threads) leading to phishing IPTV/sports-streaming sites, droppers on GitHub Releases with daily hash rotation, Virbox and Golden Crypt packers, RC4/XOR payload protection, WebSocket C2 with a custom Yamux implementation on ports 8443-8445 (/control, /data, /tunnel), 182+ targeted banking/crypto apps, and reported pricing of $2,500 per three months. That Cleafy campaign is a distinct operation from the Group-IB META campaign, and its infrastructure is recorded here only as family-level IOCs. Note that Group-IB's 'META' means Middle East, Turkey and Africa, not Meta Platforms. No CVE is involved; infection relies on social engineering and abuse of the Accessibility Service.

## MITRE ATT&CK

- T1660 Phishing
- T1453 Abuse Accessibility Features
- T1417.002 Input Capture: GUI Input Capture
- T1417.001 Input Capture: Keylogging
- T1624.001 Event Triggered Execution: Broadcast Receivers
- T1655.001 Masquerading: Match Legitimate Name or Location
- T1629.001 Impair Defenses: Prevent Application Removal
- T1629.003 Impair Defenses: Disable or Modify Tools
- T1406.002 Obfuscated Files or Information: Software Packing
- T1636.004 Protected User Data: SMS Messages
- T1517 Access Notifications
- T1513 Screen Capture
- T1512 Video Capture
- T1418 Software Discovery
- T1422 System Network Configuration Discovery
- T1437.001 Application Layer Protocol: Web Protocols
- T1604 Proxy Through Victim
- T1646 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Mirax Android RAT - 'Google Play Services' Cyrillic Homoglyph Masquerade (T1655.001)** (`TL-2026-5306-SPL-001`)

Detects Android apps labelled 'Google Play Services' (including the Cyrillic 'o' homoglyph variant reported by Group-IB for Mirax / MiraxBot, build tag aquafina) whose package is not the genuine com.google.android.gms. Mirax impersonates Google Play Services, generates a fresh package name per build (e.g. net.wgrjvz.toolyt93a) and then requests the Accessibility Service (T1453) for full device takeover. Behaviour-first: fires on the masquerade, not on rotating hashes or package names.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1655.001, T1453
- **Data sources:** mtd:android:app_inventory, DeviceTvmSoftwareInventory, android mtd app inventory
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=mobile sourcetype="mtd:android:app_inventory" earliest=-24h
| where match(app_name, "(?i)^G[oOоО]{2}gle +Play +Services$")
| where package_name!="com.google.android.gms"
| eval spoof_type=if(app_name=replace(app_name,"[^ -~]",""),"ascii_name_spoof","cyrillic_homoglyph")
| stats earliest(_time) as first_seen latest(_time) as last_seen values(spoof_type) as spoof_type values(accessibility_enabled) as accessibility_enabled by device_id, user, app_name, package_name
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
// DeviceTvmSoftwareInventory is a snapshot table (no Timestamp); schedule the rule daily
DeviceTvmSoftwareInventory
| where OSPlatform =~ 'Android'
| where SoftwareName matches regex '(?i)^G[oOоО]{2}gle +Play +Services$'
| where not(SoftwareVendor =~ 'google' and SoftwareName matches regex '^[ -~]+$')
| project DeviceId, DeviceName, SoftwareVendor, SoftwareName, SoftwareVersion, OSVersion
```

### Sigma

```yaml
title: Mirax Android RAT Google Play Services Homoglyph Masquerade
id: 3f6c1a52-8d47-4b9e-a1c3-5e2b7d90f101
status: experimental
description: Detects an Android app labelled 'Google Play Services' (including the Cyrillic 'o' homoglyph variant) installed under a package other than com.google.android.gms, as used by the Mirax Android RAT (MiraxBot, build tag aquafina).
references:
  - https://www.group-ib.com/blog/mirax-android-device-takeover-rat/
  - https://www.cleafy.com/cleafy-labs/mirax-a-new-android-rat-turning-infected-devices-into-potential-residential-proxy-nodes
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.defense-evasion
  - attack.t1655.001
  - attack.credential-access
  - attack.t1453
logsource:
  product: android
  service: mtd
detection:
  selection:
    app_name|re: '(?i)^G[oOоО]{2}gle +Play +Services$'
  filter_genuine:
    package_name: 'com.google.android.gms'
  condition: selection and not filter_genuine
falsepositives:
  - Internal test builds or OEM forks that deliberately reuse the Google Play Services label
level: high
```

**Known false positives:**

- Enterprise-signed internal apps or OEM forks that reuse the Google Play Services display name
- Test devices running custom ROMs with a renamed GMS package

**Tuning notes:** Index/sourcetype assume a mobile threat defense or MDM app-inventory feed normalised to app_name, package_name, device_id, user; map to your feed's field names. Allowlist OEM GMS forks by package name. Pivot hits to accessibility_enabled=true as highest priority.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Mirax Android RAT - Known APK Sample Hash or Package Match (T1660) (locked: unlock with TL Creds)
- Mirax Android RAT - Accessibility-Driven Uninstall and Security App Blocking with Boot Persistence (T1629.001, T1629.003, T1624.001) (locked: unlock with TL Creds)
- Mirax Android RAT - C2 Domains and Residential Proxy Fan-out (T1437.001, T1604, T1646) (locked: unlock with TL Creds)
- Mirax Android RAT - Dropper Delivery Domain DNS Lookup (T1660) (locked: unlock with TL Creds)
- Mirax Android RAT - Hidden Launcher Icon with Accessibility and Boot Receiver (T1453, T1624.001, T1655.001) (locked: unlock with TL Creds)
- Mirax Android RAT - Yamux WebSocket C2 Endpoints /control /data /tunnel on Ports 8443-8445 (T1437.001, T1646) (locked: unlock with TL Creds)
- Mirax Android RAT - Non-System App Granted Accessibility, SMS, Overlay and Boot Permissions (T1453, T1517, T1636.004, T1624.001) (locked: unlock with TL Creds)
- Mirax Android RAT - C2 Domain Resolution or Proxy Access ([indicator], [indicator], [indicator]) (T1437.001) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 29)

Defanged, TLP:CLEAR.

- Domain: `oscofneuid[.]com`
- File hash: `b9e84889c9760460f53c9b49cb43a636bb721d28`
- Domain: `kenobuias[.]com`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [From Streaming to Stealing: Mirax and the Rise of Server-side Android Device Takeover in META](https://www.group-ib.com/blog/mirax-android-device-takeover-rat/)
- [Mirax: a new Android RAT turning infected devices into potential residential proxy nodes (Cleafy Labs)](https://www.cleafy.com/cleafy-labs/mirax-a-new-android-rat-turning-infected-devices-into-potential-residential-proxy-nodes)
- [Mirax malware campaign hits 220K accounts, enables full remote control (Security Affairs)](https://securityaffairs.com/190842/uncategorized/mirax-malware-campaign-hits-220k-accounts-enables-full-remote-control.html)
- [Mirax RAT Targets Android Devices Through Meta Apps (BankInfoSecurity)](https://www.bankinfosecurity.com/mirax-rat-targets-android-devices-through-meta-apps-a-31421)
- [Mirax RAT expands mobile banking and surveillance threats (Zimperium)](https://zimperium.com/blog/mobile-threat-watch/mirax-rat-expands-mobile-banking-and-surveillance-threats)
- [Mirax Android RAT: Defending against Meta ad campaigns and SOCKS5 proxy abuse (Security Arsenal)](https://securityarsenal.com/blog/mirax-android-rat-defending-against-meta-ad-campaigns-and-socks5-proxy-abuse)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5306