From Streaming to Stealing: Mirax and the Rise of Server-side Android Device Takeover in META
Source AlienVault OTX General
Description
Between March and September 2026, thousands of Android devices in the META region were infected with Mirax malware, causing millions in estimated losses. The campaign uses malicious advertisements within low-reputation streaming apps on Google Play to distribute droppers installing the payload. Mirax impersonates Google Play Services using Cyrillic characters and coerces victims into granting Accessibility Service permissions, enabling complete device takeover. The malware employs server-side configuration with dual-WebSocket C2 infrastructure, DNS-over-HTTPS, and dynamically pushed phishing templates targeting over 20 regional banks and digital wallets. Attackers perform real-time remote control to execute unauthorized transactions appearing legitimate, with funds transferred to suspected mule accounts in India. Activity peaked during Eid holidays and remains ongoing.
Indicators of compromise
Domains 1
- kenobuias.com