Mirax Android RAT Drains META Bank Accounts Through Fake Google Play Services App
Do Son 
Android malware campaign statistical summary | Image: Group-IB
| At a glance | |
| Malware family | Mirax, an Android device takeover (DTO) RAT sold as private malware-as-a-service |
| Threat actor | Unknown affiliates of a developer using the handle “MiraxBot” |
| Targets | Retail banking customers in the META region; 20+ banks and digital wallets |
| Delivery vector | Malicious ads inside free streaming apps on Google Play, leading to an off-store dropper |
| Key capabilities | Accessibility abuse, overlay phishing, OTP theft, remote control, PIN replay, SOCKS5 proxy |
| Source | Group-IB Threat Intelligence |
TL;DR
Between March and September 2026, Group-IB confirmed thousands of Android phones in the META region infected with the Mirax Android RAT. The device takeover malware lets operators drive victims’ banking apps in real time. Group-IB estimates losses in the millions of US dollars, and the campaign is still active.
Delivery
The lure looks harmless. Victims install a free video streaming app from Google Play. However, Group-IB says evidence suggests the app’s ad banners lead users to a dropper downloaded outside the official store.
One confirmed dropper posed as an adult version of TikTok. It has no link to TikTok. Infections spiked twice: over the Eid holidays and at the end of July.
Infection chain
A fake Google Play Services app
The Mirax payload calls itself “Google Play Services.” It even swaps a Latin letter for a Cyrillic one in the name. Next, it pushes victims step by step toward enabling Accessibility Service.
That single permission is what turns the Mirax Android RAT into full device takeover malware. With it, operators can read the screen, intercept SMS codes, and tap through apps. Mirax also captures the lock-screen PIN, password, or pattern. It can later replay it to unlock the phone while the owner is not looking.
Built to stay hidden
Each build uses a random package name. The app also hides its launcher icon, so nothing appears in the app drawer. In addition, the campaign rotates app names to stay ahead of takedowns.
Mirax fights removal too. It blocks access to its uninstall screen and can stop security apps from launching. It also shows black screens, including a fake “updating” message, to hide its activity.
Draining accounts
With live control, operators open the victim’s own banking app and send money. From the bank’s view, little looks wrong. As Group-IB notes, “the activity and transactions come from the customer’s own device, app, and from the expected location.”
Funds went to new beneficiaries, internal transfers, and online shop purchases. Some international transfers reached suspected mule accounts in India.
Command-and-control and data exfiltration
Mirax ships “deliberately light” on code and settings. Its C2 runs two WebSocket channels on one host: one for commands and one for stolen data. An HTTP long-poll fallback keeps it connected if WebSockets fail.
Almost every connection setting can change remotely, including ports, TLS, and polling intervals. Meanwhile, DNS-over-HTTPS hides C2 lookups from local and carrier DNS monitoring.
The phishing overlays are not inside the app at all. Instead, the server pushes them after checking which banking apps the victim has installed. Group-IB warns that inspecting an installed sample “only shows what Mirax could do at the moment of install.”
A February 2026 update also added a SOCKS5 module. It turns each infected phone into a residential proxy. That lets fraud traffic come from the victim’s own IP address.
Who is behind it
The Mirax Android RAT has been sold on Russian-language crime forums since December 2025 by a developer using the handle “MiraxBot.” Access is limited to vetted affiliates. The META samples all carry the build tag “aquafina,” which ties them to one operation across several C2 hosts. However, Group-IB has not identified the affiliate behind that campaign.
Defense and detection guidance
Group-IB stresses that detection tied only to the installed sample “is likely to remain a step behind.” Key steps include:
- Never install apps from links inside ads, even when the ad appears in a Play Store app.
- Be wary of any app that pushes you to enable Accessibility Service.
- Check for duplicate or oddly named “Google Play Services” entries in app settings.
- Banks should watch for new beneficiaries followed by fast international transfers.
- Banks should also flag sessions where Accessibility or screen-sharing is active.
- Monitor for devices acting as proxies or using unusual DNS-over-HTTPS traffic.
In short, the Mirax Android RAT keeps its real power on the server. Defenders need to watch behavior, not just files.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
