A sprawling Android banking trojan campaign is using advertisements inside low-reputation streaming apps as its entry point, infecting thousands of phones across the Middle East, Turkey, and Africa and draining victims’ bank accounts in the process. Researchers at Group-IB, who published their findings on November 5, have named the malware family Mirax, and say it has been active since at least March 2026, with infection spikes around Eid and in late July.

From a streaming app ad to a hijacked phone

The infection chain starts somewhere ordinary: a user downloads a low-quality streaming app from Google Play, drawn in by the promise of free movies or live TV. Ads and video links inside that app then steer the user toward a separate installer hosted outside the Play Store. One confirmed lure posed as “TikTok 18+,” an installer with no actual connection to TikTok or ByteDance, designed purely to sound enticing enough to click.

That installer retrieves the Mirax payload, which disguises itself as Google Play Services using a Cyrillic character that closely resembles the Latin letter “o” in its name, a small visual trick meant to make a dangerous permission request look like it’s coming from a trusted system component. From there, the malware pushes victims to enable Android’s Accessibility Service, the permission that gives it the ability to read on-screen content and control the interface directly, the real turning point in the attack.

What Mirax can actually do once installed

With Accessibility access granted, Mirax can intercept SMS messages and notifications, record typed input, and capture lock-screen PINs, passwords, or swipe patterns. That data lets operators replay credentials to unlock a phone while the owner isn’t looking, open a live banking session, add new payment beneficiaries, or initiate transfers, all from the victim’s own device and banking app.

That last detail is what makes the fraud especially hard for banks to catch. Because transactions originate from the customer’s genuine phone running their real banking app, the usual red flags tied to unfamiliar devices or locations simply aren’t there. Group-IB’s investigation found evidence of international transfers, internal account-to-account movements, and even marketplace purchases made with stolen funds, with some proceeds apparently funneled through mule accounts in India, though investigators say they are still tracing where the money ultimately lands.

Built to evade detection and keep working

Mirax’s targeting instructions and banking overlay templates don’t ship inside the app itself. Instead, they’re delivered after installation from command-and-control infrastructure, which lets operators update what the malware impersonates and which apps it attacks without pushing a new malicious build. Group-IB’s analysis found the campaign targeting more than 20 distinct banking and digital wallet apps, plus a number of global cryptocurrency exchanges.

• Two separate WebSocket channels split command traffic from stolen data, with HTTP long-polling as a fallback if WebSockets are blocked.
• Operators can remotely reconfigure hosts, ports, TLS settings, and polling intervals on the fly.
• DNS-over-HTTPS is enabled by default, which blinds network defenders who rely on local DNS monitoring to spot suspicious traffic.
• A built-in SOCKS5 proxy module can turn an infected phone into a residential proxy, letting attackers route other traffic through the victim’s own internet connection and IP reputation.

The malware also hides its own launcher icon, randomizes its package name on each install, and restores itself automatically after a reboot. It can block security apps, obstruct the uninstall screen, and throw up fake “updating” overlays to buy itself more time while fraud is actively happening in the background.

Still live on Google Play

Perhaps the most concerning part of Group-IB’s report is that, as of publication, the operation was still active and the streaming apps assessed as likely advertising vectors remained available for download on Google Play. That means new infections are plausible for as long as the lure apps stay listed.

Security teams and individual users alike should treat this as a reminder that Accessibility Service permissions are high-value targets for attackers precisely because of how much control they grant. Group-IB recommends organizations and mobile security teams specifically hunt for signs of Accessibility abuse, unexpected remote-control activity, and unauthorized screen-sharing sessions on managed or BYOD Android devices.

Practical steps for users and security teams

• Avoid installing apps from outside Google Play, and be especially cautious of streaming or IPTV apps advertised heavily within other apps.
• Review which apps on your device have been granted Accessibility Service permissions, and revoke access for anything that doesn’t legitimately need it.
• Enable banking app notifications and regularly review transaction history for unfamiliar transfers or new beneficiaries.
• Mobile threat defense tools should be configured to flag apps requesting Accessibility permissions shortly after installation from unofficial sources.
• Banks serving affected regions should consider additional behavioral fraud signals beyond device and location trust, given that Mirax transactions originate from the victim’s genuine device.