Malware · 4 min read
Group-IB says Mirax takes over Android phones through ads in streaming apps, then empties bank accounts
Researchers confirmed thousands of infections in the Middle East, Turkey and Africa from March to September. The malware abuses Accessibility access and was still active at publication.
On November 5, 2026, Group-IB published a report on an Android malware campaign it tracks as Mirax. Between March and September 2026, the firm says, thousands of phones belonging to retail banking customers in the Middle East, Turkey and Africa (the META region) were confirmed to be infected. In cases where unauthorised international transfers were reported, the money went to accounts abroad, some of them suspected mule accounts. Group-IB estimates losses in the millions of US dollars, counting only what it can confirm, and says the campaign was still running when it published. Here’s how the malware gets on a phone, and what to check for.
How it arrives
The lure looks ordinary: a free video streaming app on the Google Play Store. Group-IB says users who download low-reputation streaming apps are shown advertisements inside the app. Evidence suggests those ad banners lead to a dropper downloaded outside the official store, and that dropper installs the Mirax payload.
The payload pretends to be “Google Play Services,” swapping a Cyrillic “о” for the Latin letter, and pushes the owner to grant Accessibility Service access. That single permission is what turns the infection into a full device takeover. The launcher icon is hidden at runtime, package names are randomised for each build, and the campaign rotates app names so it is harder to take down.
What it can do
Mirax is a device take-over family: with Accessibility access, the operator can see and control the phone in real time. Group-IB says that includes reading credentials, intercepting one-time codes, capturing the PIN used to unlock the device later, opening a banking app, and moving money to newly added beneficiaries and mule accounts abroad. From the bank’s point of view, little looks unusual. The activity comes from the customer’s own device, app and expected location.
The first-stage app is deliberately light. Command-and-control addresses, timing, DNS-over-HTTPS behaviour and even the phishing and HTML-injection templates tailored to individual banking apps are fetched from the attacker’s server after installation. A hardcoded address in the sample is only a rendezvous point.
Group-IB saw two large spikes in activity, over the Eid holidays and at the end of July. The number of infected devices is higher than the number of identified samples, which fits with the same build being reused across victims.
This is a more complete takeover than the Android banking trojans and Hirudo campaigns we have covered earlier this autumn, but it leans on the same warning sign: a request for Accessibility access that a regular app does not need.
What you can do
- Be careful with free streaming apps, especially ones with poor reviews or that quickly ask you to install something from outside Google Play.
- Don’t grant Accessibility access to an app that is not a genuine assistive tool you chose, including anything that claims to be “Google Play Services” after you already have that on your phone.
- Review Accessibility, device-admin and default-app settings on your phone, and remove anything you don’t recognise. On Android, that’s usually under Settings, then Accessibility.
- Watch banking apps for new payees or transfers you didn’t make, and contact your bank through a number on the back of your card if you see either.
- Keep Google Play Protect on, and install banking apps only from the official store.
How Frame helps
Mirax infects phones rather than publishing a list of email addresses, so there isn’t a breach record to add in Frame. Frame can also look up your verified emails in Have I Been Pwned’s breach database for other breaches. Frame doesn’t scan Android devices for this malware.
Related coverage
- Two new Android banking trojans, one warning sign: the Accessibility permission: earlier campaigns that also needed Accessibility access to control a phone.
- Hirudo swaps your real banking app for a patched copy that blinds its own security checks: another Android banking trojan that starts with a fake update.
- iVerify says criminals, not governments, now cause most of the iPhone spyware it finds: a different platform, and a reminder that commercially available spyware is no longer only a government story.
Sources
- Group-IB, From Streaming to Stealing: Mirax and the Rise of Server-side Android Device Takeover in META, November 5, 2026
More stories
- MalwareAttackers used AntiFox, an open-source AI hacking agent, to reach AWS production secrets · 4 min read
- MalwareMicrosoft: attackers keep a back door into hacked Linux web servers with GSocket · 4 min read
- MalwareAttackers go after Qlik Sense servers and stage exploits for ActiveMQ and Veeam · 4 min read
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.