A remote access trojan known as Mirax is infecting Android phones to steal banking passwords, intercept one-time passwords (OTPs), and facilitate fraudulent transactions This article explores mirax infecting android. . Over 2,000 infected devices, primarily used by retail banking customers in the META region, were discovered between March and September 2026.
Security experts predict substantial financial losses, estimated in millions of US dollars, based on telemetry and confirmed cases reported by affected banks.
One confirmed instance involved the name “Tiktok 18+,” which appears to be a deceptive link that redirects users to download the Mirax RAT. After installation, the payload replaces a Latin letter with a similar-looking Cyrillic character, impersonating "Google Play Services." It then asks users to grant Accessibility Service access, a crucial permission for its device takeover capabilities.
With this access, attackers can monitor screens, record keystrokes, steal credentials, and intercept SMS messages and notifications containing OTPs.
It can block uninstall screens and security apps, and uses black overlays or fake updating screens to hide malicious activity. Indicators of Compromise Android package name SHA-1 hash Reported installation date net.wgrjvz.toolyt93a b9e84889c9760460f53c9b49cb43a636bb721d28 August 6, 2026 org.xrmhvlfx.litewnj3h 8531fe2db41e9e08525080be6d3e8092c5ffa5f8 July 31, 2026 Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort.
