Mirax Android Banking RAT Abuses Accessibility Services for Device Takeover and Bank Fraud in the Middle East, Türkiye and Africa

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5707 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Mirax C2 Rendezvous Domains — oscofneuid.com / kenobuias.com in DNS and Web Proxy Logs

Searches DNS and web-proxy telemetry for queries or requests to the Group-IB confirmed Mirax C2 domains oscofneuid.com and kenobuias.com. Mirax uses two persistent WebSocket channels (commands and exfiltration) with an HTTP long-polling fallback, so repeated or long-lived contact from one mobile client is expected; builds with DNS-over-HTTPS enabled may bypass DNS and appear only in proxy/TLS logs.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1437.001, T1521, T1646
• Data sources: splunk:index=dns sourcetype=stream:dns, splunk:index=proxy sourcetype=zscalernss-web, dns_logs, web_proxy
• Severity: high
• Confidence: high

Splunk SPL

(index=dns sourcetype="stream:dns") OR (index=proxy sourcetype="zscalernss-web") ```TL-2026-5707 Mirax C2 rendezvous domains oscofneuid.com and kenobuias.com (WebSocket command + data channels, HTTP long-poll fallback)```
| eval dest=lower(coalesce(query, host, hostname))
| where match(dest,"(^|\.)(oscofneuid\.com|kenobuias\.com)\.?$")
| fillnull value="unknown" user src_ip
| stats count AS events min(_time) AS first_seen max(_time) AS last_seen values(sourcetype) AS sources values(dest) AS dest by src_ip user
| eval contact_pattern=if(events>=2 AND last_seen-first_seen>=300,"repeated_or_long_lived","single_contact")
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen src_ip user dest sources events contact_pattern

Microsoft KQL

let vendor_c2 = dynamic(['oscofneuid.com','kenobuias.com']);
let dns_hits = DnsEvents
| where TimeGenerated > ago(24h)
| extend Dest = tolower(trim_end(@'\.', Name))
| where Dest has_any (vendor_c2)
| project TimeGenerated, Source = 'DnsEvents', SrcIp = ClientIP, Dest;
let proxy_hits = CommonSecurityLog
| where TimeGenerated > ago(24h)
| extend Dest = tolower(iff(isnotempty(DestinationHostName), DestinationHostName, tostring(parse_url(RequestURL).Host)))
| where Dest has_any (vendor_c2)
| project TimeGenerated, Source = 'CommonSecurityLog', SrcIp = SourceIP, Dest;
union dns_hits, proxy_hits
| summarize Events = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Sources = make_set(Source) by SrcIp, Dest
| extend SpanMinutes = datetime_diff('minute', LastSeen, FirstSeen)
| order by LastSeen desc

Sigma

title: Mirax Android Banking RAT C2 Domain Resolution (oscofneuid.com, kenobuias.com)
id: f1c92d58-6a3e-4d07-b84f-0e5a7c13d9b2
status: experimental
description: Detects DNS queries for the Mirax C2 domains oscofneuid.com and kenobuias.com published by Group-IB (TL-2026-5707). Mirax maintains WebSocket command and data channels with HTTP long-polling fallback.
references:
    - https://www.group-ib.com/blog/mirax-android-device-takeover-rat/
    - https://attack.mitre.org/techniques/T1437/001/
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.command-and-control
    - attack.exfiltration
    - attack.t1437.001
    - attack.t1521
    - attack.t1646
logsource:
    category: dns
detection:
    selection:
        query|endswith:
            - 'oscofneuid.com'
            - 'kenobuias.com'
    condition: selection
falsepositives:
    - Threat-intel sinkhole or security-research lookups of these domains
    - Passive DNS replay or blocklist-feed processing hosts
level: high

Known false positives:

• Security researchers or sandboxes resolving the published C2 domains
• Threat-intel enrichment pipelines that look up blocklisted domains

Tuning notes: Domains come from Group-IB; BeaconBeagle lookups were unverified, and the hardcoded host is only a rendezvous point that operators can reconfigure, so expect rotation. Builds with DNS-over-HTTPS enabled bypass DNS logs: also hunt proxy/TLS SNI, and alert on mobile clients reaching public DoH resolvers. Exclude sinkhole/research source IPs.

• 🔒 Mirax-Style Masquerading — Fake 'Google Play Services' and Mixed-Script (Cyrillic Homoglyph) App Names Outside Google Play · unlock with TL Creds
• 🔒 Mirax Overlay and Remote-Control Capability — Sideloaded App Combining Accessibility, Draw-Over-Apps and Camera/SMS Access · unlock with TL Creds
• 🔒 Mirax Community-Related Sibling Infrastructure — Streaming-Lure Domains in DNS and Proxy Logs (Low-Confidence Corroboration) · unlock with TL Creds
• 🔒 Mirax IOC Sweep — Dropper [indicator] and 19 Published Payload Packages / SHA-1 Hashes in Mobile Inventory · unlock with TL Creds
• 🔒 Mirax Persistence and Anti-Removal — Hidden-Icon Sideloaded App With Boot Receiver and Accessibility/Device-Admin Binding · unlock with TL Creds
• 🔒 Mirax C2 and Related Infrastructure — Confirmed C2 Domains plus Community Sibling Domains with Confidence Tiering · unlock with TL Creds
• 🔒 Mirax Android DTO RAT — Known Dropper/Payload Packages, SHA-1s and 'Google Play Services' Masquerade on Managed Devices · unlock with TL Creds
• 🔒 Mirax-style Accessibility Abuse — Non-System App With No Launcher Icon Holding Accessibility plus SMS/Notification Access · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-5707.

Sample indicators (3 of 26)

• Domain: oscofneuid[.]com
• File hash: 8c696e368d45283872818492714dfea92728ae6f
• Domain: kenobuias[.]com

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

Technical analysis

Mirax is an Android Device Takeover RAT and banking malware tracked by Group-IB, which published its technical investigation on 2026-11-05. It is operated as a private malware-as-a-service by a developer using the handle 'MiraxBot', sold on Russian-language cybercrime forums since December 2025 with access limited to vetted affiliates (priority for Russian-speaking actors). The service includes a builder, selectable packers and a web panel for managing infected devices. A February 2026 update added a SOCKS5 residential proxy module. Group-IB links the build tags 'aquafina' and 'aquafina_all' to one operation spanning multiple C2 hosts.

Distribution: low-reputation free streaming/video apps on Google Play show ad banners and video links that lead victims to a dropper hosted outside the store. One confirmed dropper (net.hzzor.lite87n9) posed as an NSFW app labelled 'Tiktok 18+' (not affiliated with TikTok/ByteDance). The dropper downloads the second-stage Mirax payload, which masquerades as 'Google Play Services' using a Cyrillic 'о' homoglyph in its display name. Package names are randomized per build (19 payload packages published as IOCs).

Capabilities: on-device prompts push the victim to grant the Accessibility Service permission, which enables real-time screen monitoring, keylogging, notification and SMS collection (OTP theft), capture of the lock-screen PIN/password/pattern for later replay to unlock unattended devices, hidden VNC/screen sharing, camera access, clipboard read/write, remote tap/swipe/text input, and HTML overlay injection against banking, crypto, email and social apps. Overlay templates and target-app mappings are pushed by the C2 per device rather than shipped in the APK. Persistence and evasion include hiding the launcher icon at runtime, restart via Broadcast Receivers, uninstall protection, blocking of security/antivirus apps and uninstall screens, and black overlays including a fake 'updating' screen to hide fraud activity.

C2: two persistent WebSocket channels on a single host (one for commands, one for data exfiltration) with an HTTP long-polling fallback. The hardcoded address is only a rendezvous point; host, both ports, TLS parameters, DNS-over-HTTPS (on by default in newer builds) and polling intervals are remotely configurable. Group-IB's appendix lists a large command set (e.g. startVncScreenSharing, unlockDevice, addHtmlInjectionConfig, startSmsCollection, socks5_enable, enableUninstallProtection, blockApp).

Impact: 20+ banking/wallet packages and a couple of global crypto exchanges are targeted, affecting retail banking customers in the META region. Thousands of devices and (preliminarily) thousands of bank accounts across several institutions were affected, with activity spikes around Eid and in late July 2026. Monetization includes adding beneficiaries for international transfers, internal transfers and eShop purchases; evidence suggests mule accounts in India, but the final destination of funds is not established. No CVE is involved; this is a social-engineering/permission-abuse threat. Group-IB's MITRE mapping was published only as images, so the technique mapping here is derived from the described behaviors. Two sources were read in full (Group-IB, Cyber Security News); BeaconBeagle lookups for the two domains returned HTTP 502 and are unverified.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1406.002 Obfuscated Files or Information: Software Packing; T1407 Download New Code at Runtime; T1516 Input Injection; T1628.001 Hide Artifacts: Suppress Application Icon; T1629.001 Impair Defenses: Prevent Application Removal; T1655.001 Masquerading: Match Legitimate Name or Location

Collection

T1414 Clipboard Data; T1512 Video Capture; T1513 Screen Capture; T1636.004 Protected User Data: SMS Messages

Credential Access

T1417.001 Input Capture: Keylogging; T1417.002 Input Capture: GUI Input Capture; T1517 Access Notifications

Discovery

T1418 Software Discovery

Command and Control

T1437.001 Application Layer Protocol: Web Protocols; T1521 Encrypted Channel

defense-evasion

T1604 Proxy Through Victim

Persistence

T1624.001 Event Triggered Execution: Broadcast Receivers

Exfiltration

T1646 Exfiltration Over C2 Channel

Remediation

Immediate actions

• Block oscofneuid.com and kenobuias.com at DNS/proxy and hunt for them in logs; note DoH-by-default builds can bypass conventional DNS monitoring, so also inspect TLS/WebSocket egress from mobile devices
• Search MDM/EMM inventories for the dropper package net.hzzor.lite87n9 and the 19 payload package names / SHA-1 hashes listed as IOCs
• Flag any app named 'Google Play Services' that is not the genuine com.google.android.gms package, including look-alikes with a Cyrillic 'о'
• Banks: review suspicious new-beneficiary and international-transfer requests and verify out-of-band with the customer

Workarounds

• Refuse unexpected Accessibility Service requests, especially from entertainment/streaming apps
• Use Google Play Protect and remove apps that hide their icon or resist uninstall; boot into safe mode or revoke Accessibility/device-admin access before uninstalling

Longer-term hardening

• Banks: correlate transaction attempts with Accessibility-service abuse, screen-sharing and remote-control signals rather than relying only on file signatures
• Use mobile threat defense / app-vetting that alerts on non-system apps holding Accessibility, SMS, notification-listener and device-admin permissions
• Restrict sideloading and install from unknown sources on managed devices; educate users not to install apps promoted through ads

Affected and fixed versions

• Google — Android (all versions where the user can be induced to grant Accessibility Service access)
  Vulnerable versions: User-granted permission abuse; not version-specific
• Various — 20+ banking and digital-wallet apps and some global crypto exchange apps in the Middle East, Türkiye and Africa (names not published)
  Vulnerable versions: Not specified

Timeline

• 2025-12-01 Mirax begins to be sold on Russian-language cybercrime forums by developer 'MiraxBot' (Group-IB gives month only; day is approximate).
• 2026-02-01 Update adds a SOCKS5 residential proxy module (Group-IB gives month only; day is approximate).
• 2026-03-01 Start of the March-September 2026 window in which Group-IB confirms thousands of infected Android phones in the META region (day approximate).
• 2026-06-29 Earliest install date listed in Group-IB's IOC table (io.vvecxa.clientffb).
• 2026-07-31 Activity spike observed at the end of July 2026 (Group-IB); many listed payloads were installed between 2026-07-28 and 2026-08-06 (spike day approximate).
• 2026-08-06 Latest install date in the published IOC table (net.wgrjvz.toolyt93a, io.xccqt.helper3mk, net.mfiaekme.toolgdqvu).
• 2026-09-30 End of the March-September 2026 infection window cited by Group-IB (day approximate).
• 2026-11-05 Group-IB publishes its technical investigation of Mirax; campaign still active with operators rotating app names and infrastructure.
• 2026-11-10 Cyber Security News reports the Group-IB findings, including dropper and domain IOCs.

Sources cited

• MITRE ATT&CK Mobile T1417: Input Capture MITRE · Advisory
• MITRE ATT&CK Mobile T1516: Input Injection MITRE · Advisory
• MITRE ATT&CK Mobile T1604: Proxy Through Victim MITRE · Advisory
• Group-IB: Mirax Android device takeover RAT group-ib.com · Research · 2026-11-05
• Group-IB: RemControl Android banking trojan (related Accessibility-abuse DTO family, for context) group-ib.com · Research
• New Mirax Android Malware Uses Accessibility Services to Remotely Control Phones and Steal Bank Funds (Cyber Security News) cybersecuritynews.com · News · 2026-11-10

More in malware

• RemControl: Android banking trojan MaaS abusing Accessibility Service, AI-assisted phishing overlays (affiliate UNKK)
• Exvicy: ClickFix MaaS Framework Copycat of ErrTraffic Distributing Malware via Compromised WordPress Sites
• Blind Eagle (APT-C-36) Uses Fake Court Notices to Deliver AsyncRAT/DCRat-Lineage RAT Across Latin America
• GhostFrame: New ESXi Post-Exploitation Implant Linked to TAG-218 / Settra Ransomware
• Formbook (XLoader) Campaign Targets European Manufacturing and Technology Businesses with Localized Order Lures

More from MiraxBot

• Mirax Android RAT: Server-side Device Takeover Targeting META Banking Customers via Malicious Ads in Streaming Apps