# Mirax Android Banking RAT Abuses Accessibility Services for Device Takeover and Bank Fraud in the Middle East, Türkiye and Africa

> Mirax is a privately sold Android device-takeover (DTO) RAT and banking malware that abuses Accessibility Services to capture credentials, intercept SMS/OTP codes, replay lock-screen secrets and let operators remotely drive banking apps to add beneficiaries and start transfers. Group-IB confirmed thousands of infected phones between March and September 2026, with fraud losses estimated in the millions of USD (a floor).

- **Published:** 2026-11-11T01:15:23Z
- **Last reviewed:** 2026-11-11T01:15:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5707
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5707.png
- **ID:** TL-2026-5707
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** MiraxBot
- **Detections:** 9 (1 shown free below) · **IOCs:** 26 (3 shown free below)

## Description

Mirax is an Android Device Takeover RAT and banking malware tracked by Group-IB, which published its technical investigation on 2026-11-05. It is operated as a private malware-as-a-service by a developer using the handle 'MiraxBot', sold on Russian-language cybercrime forums since December 2025 with access limited to vetted affiliates (priority for Russian-speaking actors). The service includes a builder, selectable packers and a web panel for managing infected devices. A February 2026 update added a SOCKS5 residential proxy module. Group-IB links the build tags 'aquafina' and 'aquafina_all' to one operation spanning multiple C2 hosts.

Distribution: low-reputation free streaming/video apps on Google Play show ad banners and video links that lead victims to a dropper hosted outside the store. One confirmed dropper (net.hzzor.lite87n9) posed as an NSFW app labelled 'Tiktok 18+' (not affiliated with TikTok/ByteDance). The dropper downloads the second-stage Mirax payload, which masquerades as 'Google Play Services' using a Cyrillic 'о' homoglyph in its display name. Package names are randomized per build (19 payload packages published as IOCs).

Capabilities: on-device prompts push the victim to grant the Accessibility Service permission, which enables real-time screen monitoring, keylogging, notification and SMS collection (OTP theft), capture of the lock-screen PIN/password/pattern for later replay to unlock unattended devices, hidden VNC/screen sharing, camera access, clipboard read/write, remote tap/swipe/text input, and HTML overlay injection against banking, crypto, email and social apps. Overlay templates and target-app mappings are pushed by the C2 per device rather than shipped in the APK. Persistence and evasion include hiding the launcher icon at runtime, restart via Broadcast Receivers, uninstall protection, blocking of security/antivirus apps and uninstall screens, and black overlays including a fake 'updating' screen to hide fraud activity.

C2: two persistent WebSocket channels on a single host (one for commands, one for data exfiltration) with an HTTP long-polling fallback. The hardcoded address is only a rendezvous point; host, both ports, TLS parameters, DNS-over-HTTPS (on by default in newer builds) and polling intervals are remotely configurable. Group-IB's appendix lists a large command set (e.g. startVncScreenSharing, unlockDevice, addHtmlInjectionConfig, startSmsCollection, socks5_enable, enableUninstallProtection, blockApp).

Impact: 20+ banking/wallet packages and a couple of global crypto exchanges are targeted, affecting retail banking customers in the META region. Thousands of devices and (preliminarily) thousands of bank accounts across several institutions were affected, with activity spikes around Eid and in late July 2026. Monetization includes adding beneficiaries for international transfers, internal transfers and eShop purchases; evidence suggests mule accounts in India, but the final destination of funds is not established. No CVE is involved; this is a social-engineering/permission-abuse threat. Group-IB's MITRE mapping was published only as images, so the technique mapping here is derived from the described behaviors. Two sources were read in full (Group-IB, Cyber Security News); BeaconBeagle lookups for the two domains returned HTTP 502 and are unverified.

## MITRE ATT&CK

- T1655.001 Masquerading: Match Legitimate Name or Location
- T1407 Download New Code at Runtime
- T1406.002 Obfuscated Files or Information: Software Packing
- T1628.001 Hide Artifacts: Suppress Application Icon
- T1629.001 Impair Defenses: Prevent Application Removal
- T1516 Input Injection
- T1624.001 Event Triggered Execution: Broadcast Receivers
- T1417.001 Input Capture: Keylogging
- T1417.002 Input Capture: GUI Input Capture
- T1517 Access Notifications
- T1636.004 Protected User Data: SMS Messages
- T1513 Screen Capture
- T1512 Video Capture
- T1414 Clipboard Data
- T1418 Software Discovery
- T1437.001 Application Layer Protocol: Web Protocols
- T1521 Encrypted Channel
- T1604 Proxy Through Victim
- T1646 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Mirax C2 Rendezvous Domains — oscofneuid.com / kenobuias.com in DNS and Web Proxy Logs** (`TL-2026-5707-SPL-003`)

Searches DNS and web-proxy telemetry for queries or requests to the Group-IB confirmed Mirax C2 domains oscofneuid.com and kenobuias.com. Mirax uses two persistent WebSocket channels (commands and exfiltration) with an HTTP long-polling fallback, so repeated or long-lived contact from one mobile client is expected; builds with DNS-over-HTTPS enabled may bypass DNS and appear only in proxy/TLS logs.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1437.001, T1521, T1646
- **Data sources:** splunk:index=dns sourcetype=stream:dns, splunk:index=proxy sourcetype=zscalernss-web, dns_logs, web_proxy
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
(index=dns sourcetype="stream:dns") OR (index=proxy sourcetype="zscalernss-web") ```TL-2026-5707 Mirax C2 rendezvous domains oscofneuid.com and kenobuias.com (WebSocket command + data channels, HTTP long-poll fallback)```
| eval dest=lower(coalesce(query, host, hostname))
| where match(dest,"(^|\.)(oscofneuid\.com|kenobuias\.com)\.?$")
| fillnull value="unknown" user src_ip
| stats count AS events min(_time) AS first_seen max(_time) AS last_seen values(sourcetype) AS sources values(dest) AS dest by src_ip user
| eval contact_pattern=if(events>=2 AND last_seen-first_seen>=300,"repeated_or_long_lived","single_contact")
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen src_ip user dest sources events contact_pattern
````

### Microsoft KQL

```kql
let vendor_c2 = dynamic(['oscofneuid.com','kenobuias.com']);
let dns_hits = DnsEvents
| where TimeGenerated > ago(24h)
| extend Dest = tolower(trim_end(@'\.', Name))
| where Dest has_any (vendor_c2)
| project TimeGenerated, Source = 'DnsEvents', SrcIp = ClientIP, Dest;
let proxy_hits = CommonSecurityLog
| where TimeGenerated > ago(24h)
| extend Dest = tolower(iff(isnotempty(DestinationHostName), DestinationHostName, tostring(parse_url(RequestURL).Host)))
| where Dest has_any (vendor_c2)
| project TimeGenerated, Source = 'CommonSecurityLog', SrcIp = SourceIP, Dest;
union dns_hits, proxy_hits
| summarize Events = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Sources = make_set(Source) by SrcIp, Dest
| extend SpanMinutes = datetime_diff('minute', LastSeen, FirstSeen)
| order by LastSeen desc
```

### Sigma

```yaml
title: Mirax Android Banking RAT C2 Domain Resolution (oscofneuid.com, kenobuias.com)
id: f1c92d58-6a3e-4d07-b84f-0e5a7c13d9b2
status: experimental
description: Detects DNS queries for the Mirax C2 domains oscofneuid.com and kenobuias.com published by Group-IB (TL-2026-5707). Mirax maintains WebSocket command and data channels with HTTP long-polling fallback.
references:
    - https://www.group-ib.com/blog/mirax-android-device-takeover-rat/
    - https://attack.mitre.org/techniques/T1437/001/
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.command-and-control
    - attack.exfiltration
    - attack.t1437.001
    - attack.t1521
    - attack.t1646
logsource:
    category: dns
detection:
    selection:
        query|endswith:
            - 'oscofneuid.com'
            - 'kenobuias.com'
    condition: selection
falsepositives:
    - Threat-intel sinkhole or security-research lookups of these domains
    - Passive DNS replay or blocklist-feed processing hosts
level: high
```

**Known false positives:**

- Security researchers or sandboxes resolving the published C2 domains
- Threat-intel enrichment pipelines that look up blocklisted domains

**Tuning notes:** Domains come from Group-IB; BeaconBeagle lookups were unverified, and the hardcoded host is only a rendezvous point that operators can reconfigure, so expect rotation. Builds with DNS-over-HTTPS enabled bypass DNS logs: also hunt proxy/TLS SNI, and alert on mobile clients reaching public DoH resolvers. Exclude sinkhole/research source IPs.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Mirax-Style Masquerading — Fake 'Google Play Services' and Mixed-Script (Cyrillic Homoglyph) App Names Outside Google Play (locked: unlock with TL Creds)
- Mirax Overlay and Remote-Control Capability — Sideloaded App Combining Accessibility, Draw-Over-Apps and Camera/SMS Access (locked: unlock with TL Creds)
- Mirax Community-Related Sibling Infrastructure — Streaming-Lure Domains in DNS and Proxy Logs (Low-Confidence Corroboration) (locked: unlock with TL Creds)
- Mirax IOC Sweep — Dropper [indicator] and 19 Published Payload Packages / SHA-1 Hashes in Mobile Inventory (locked: unlock with TL Creds)
- Mirax Persistence and Anti-Removal — Hidden-Icon Sideloaded App With Boot Receiver and Accessibility/Device-Admin Binding (locked: unlock with TL Creds)
- Mirax C2 and Related Infrastructure — Confirmed C2 Domains plus Community Sibling Domains with Confidence Tiering (locked: unlock with TL Creds)
- Mirax Android DTO RAT — Known Dropper/Payload Packages, SHA-1s and 'Google Play Services' Masquerade on Managed Devices (locked: unlock with TL Creds)
- Mirax-style Accessibility Abuse — Non-System App With No Launcher Icon Holding Accessibility plus SMS/Notification Access (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 26)

Defanged, TLP:CLEAR.

- Domain: `oscofneuid[.]com`
- File hash: `8c696e368d45283872818492714dfea92728ae6f`
- Domain: `kenobuias[.]com`

Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Group-IB: Mirax Android device takeover RAT](https://www.group-ib.com/blog/mirax-android-device-takeover-rat/)
- [New Mirax Android Malware Uses Accessibility Services to Remotely Control Phones and Steal Bank Funds (Cyber Security News)](https://cybersecuritynews.com/new-mirax-android-malware/)
- [MITRE ATT&CK Mobile T1417: Input Capture](https://attack.mitre.org/techniques/T1417/)
- [MITRE ATT&CK Mobile T1516: Input Injection](https://attack.mitre.org/techniques/T1516/)
- [MITRE ATT&CK Mobile T1604: Proxy Through Victim](https://attack.mitre.org/techniques/T1604/)
- [Group-IB: RemControl Android banking trojan (related Accessibility-abuse DTO family, for context)](https://www.group-ib.com/blog/remcontrol-android-banking-trojan/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5707