---
title: Tip: refuse Accessibility Service prompts from streaming or "Google Play Services" lookalikes, and uninstall the app | ctxsec
url: https://ctxsec.com/items/tip-decline-accessibility-for-streaming-apps-mirax
description: "Mirax\u2019s whole takeover chain after the dropper depends on Accessibility Service. Declining that prompt and removing the lure breaks the fraud path even if the APK already installed."
status: "operational guidance (Group-IB Mirax research, Nov 5)"
published: 2026-11-07
---

> Mirax’s whole takeover chain after the dropper depends on Accessibility Service. Declining that prompt and removing the lure breaks the fraud path even if the APK already installed.

[← Tips & Guides](/tips) · [markdown](/items/tip-decline-accessibility-for-streaming-apps-mirax.md)

operational guidance (Group-IB Mirax research, Nov 5)

2026-11-07

### Tip: refuse Accessibility Service prompts from streaming or "Google Play Services" lookalikes, and uninstall the app

- On Android: Settings → Accessibility — remove unknown services; treat Cyrillic-homoglyph "Google Play Services" entries as malware.
- Do not sideload APKs from ads inside low-reputation streaming apps.
- Banking SOCs: escalate fraud alerts that coincide with screen-sharing / remote-control telemetry on the same device.

Sources: [Group-IB: Mirax Android DTO (Nov 5)](https://www.group-ib.com/blog/mirax-android-device-takeover-rat/)