---
title: Hunt: Mirax Android device-takeover RAT reaches META banking customers via ads in low-reputation streaming apps | ctxsec
url: https://ctxsec.com/items/hunt-group-ib-mirax-android-dto-streaming-ads-meta
description: "Group-IB reports that between March and September 2026, thousands of Android phones belonging to retail banking customers in the META region were infected with Mirax, a device-takeover RAT sold as vetted MaaS since December 2025. Delivery starts with free streaming apps on Google Play whose in-app ads/video links lead to an outside-store dropper (one confirmed lure impersonated \"TikTok 18+\"); the payload impersonates \"Google Play Services\" with a Cyrillic homoglyph and coerces Accessibility Service access for live remote control, OTP/SMS theft, lock-secret capture and operator-driven banking transfers. C2 is dual-WebSocket with DoH and remote-reconfigurable transport; phishing/HTML overlays are pushed at runtime (build tag aquafina). Group-IB estimates confirmed losses in the millions of USD."
status: "vendor research (Group-IB, Nov 5); campaign still active at publish; losses estimated in millions USD from confirmed bank cases only"
published: 2026-11-07
---

> Group-IB reports that between March and September 2026, thousands of Android phones belonging to retail banking customers in the META region were infected with Mirax, a device-takeover RAT sold as vetted MaaS since December 2025. Delivery starts with free streaming apps on Google Play whose in-app ads/video links lead to an outside-store dropper (one confirmed lure impersonated "TikTok 18+"); the payload impersonates "Google Play Services" with a Cyrillic homoglyph and coerces Accessibility Service access for live remote control, OTP/SMS theft, lock-secret capture and operator-driven banking transfers. C2 is dual-WebSocket with DoH and remote-reconfigurable transport; phishing/HTML overlays are pushed at runtime (build tag aquafina). Group-IB estimates confirmed losses in the millions of USD.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-group-ib-mirax-android-dto-streaming-ads-meta.md)

vendor research (Group-IB, Nov 5); campaign still active at publish; losses estimated in millions USD from confirmed bank cases only

2026-11-07

### Hunt: Mirax Android device-takeover RAT reaches META banking customers via ads in low-reputation streaming apps

- **Network:** `oscofneuid[.]com`, `kenobuias[.]com`.
- **Packages / SHA-1 samples (Group-IB table):** e.g. `net.wgrjvz.toolyt93a` / `b9e84889c9760460f53c9b49cb43a636bb721d28`; `org.xrmhvlfx.litewnj3h` / `8531fe2db41e9e08525080be6d3e8092c5ffa5f8` (full list in the report).
- **Behavioral:** Accessibility Service grant to a non-accessibility app; hidden launcher; dual-WebSocket + DoH; screen-sharing/VNC alongside an active banking session.
- **Banks:** treat remote-control / screen-share indicators with a payment attempt as high-priority holds pending customer verification.

Sources: [Group-IB: From Streaming to Stealing — Mirax Android Device Takeover in META (Nov 5)](https://www.group-ib.com/blog/mirax-android-device-takeover-rat/)