[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

vendor research (Group-IB, Nov 5); campaign still active at publish; losses estimated in millions USD from confirmed bank cases only

Hunt: Mirax Android device-takeover RAT reaches META banking customers via ads in low-reputation streaming apps

  • Network: oscofneuid[.]com, kenobuias[.]com.
  • Packages / SHA-1 samples (Group-IB table): e.g. net.wgrjvz.toolyt93a / b9e84889c9760460f53c9b49cb43a636bb721d28; org.xrmhvlfx.litewnj3h / 8531fe2db41e9e08525080be6d3e8092c5ffa5f8 (full list in the report).
  • Behavioral: Accessibility Service grant to a non-accessibility app; hidden launcher; dual-WebSocket + DoH; screen-sharing/VNC alongside an active banking session.
  • Banks: treat remote-control / screen-share indicators with a payment attempt as high-priority holds pending customer verification.

Sources: Group-IB: From Streaming to Stealing — Mirax Android Device Takeover in META (Nov 5)