Mirax is a newly identified Android RAT operating as Malware-as-a-Service, targeting European Spanish-speaking users. It is distributed through Meta advertisements and GitHub droppers, with over 200,000 infected devices reported. The malware employs sophisticated techniques including HTML overlays, comprehensive keylogging, and remote control. A unique feature is its integration of SOCKS5-based residential proxy functionality, turning infected devices into proxy nodes to route attacker traffic through legitimate residential IP addresses. This allows bypassing geolocation restrictions and fraud detection systems during malicious activities such as account takeovers and transaction fraud. Mirax uses Golden Encryption for obfuscation and abuses Accessibility Services to maintain persistence. Indicators include domains and URLs such as ilovepng.info and descarga-smtr.net. There is no known patch or official remediation at this time.

The malware compromises Android devices by enabling attackers to remotely control them and capture sensitive input via keylogging. The SOCKS5 residential proxy feature allows attackers to route malicious traffic through infected devices, effectively masking their origin and bypassing geolocation and fraud detection controls. This facilitates account takeovers and transaction fraud, increasing the risk of financial and data loss for victims. The infection scale (over 200,000 accounts) indicates significant potential impact, especially in targeted Spanish-speaking European regions.

No official patch or remediation guidance is currently available from the vendor or authoritative sources. Organizations and users should monitor for updates from trusted security advisories. Given the malware’s distribution via Meta advertisements and GitHub-hosted droppers, caution is advised when interacting with unsolicited ads or downloading apps from untrusted sources. Employing mobile security solutions capable of detecting RAT behavior and restricting Accessibility Service abuse may help mitigate infection risk. Patch status is not yet confirmed — check vendor advisories for current remediation guidance.