From Streaming to Stealing: Mirax and the Rise of Server-side Android Device Takeover in META

    Thursday, November 5, 2026 In: Threat Research Print

    Date: 11/05/2026

    Severity: High

    Summary

    Researchers uncovered Mirax, an Android Remote Access Trojan (RAT) and Malware-as-a-Service (MaaS) platform that enables real-time device takeover through Accessibility Service abuse, screen sharing, keylogging, SMS/OTP interception, and banking application overlay injection. The campaign distributes malware through malicious advertisements embedded in low-reputation streaming applications, using dynamic Command-and-Control (C2) configurations, DNS-over-HTTPS (DoH), and WebSocket communications to evade detection. Mirax targets banking customers across the META region, facilitating unauthorized financial transactions and credential theft. Mule accounts in India were suspected of facilitating the movement and laundering of stolen funds from fraudulent international transfers.

    Indicators of Compromise (IOC) List

    Domains/URLs

    oscofneuid.com

    kenobuias.com

    Hash

    b9e84889c9760460f53c9b49cb43a636bb721d28

    8531fe2db41e9e08525080be6d3e8092c5ffa5f8

    0d83344fee8973165e5009768c1752095a57f3c1

    3a1f9060dad56cd08e87fcafa2c87b99295b3db3

    6a37c3d4beb80ae1689dbbedcb53a86f85c8e44a

    fd4a2c02ab5a99b5420538c8b1bfef6fa4fbd7fe

    2b5eeabbc52a25172123c2e7789c977e6bb557af

    d7b4d33c38deb0978b71ef79ff4df9fb90118cc2

    746dc75b1b887812db37b3801e104d887b2c8707

    c9258f527fe447431ff983aa76866e340db98e60

    ace41996dc5b7ecdb68c2222fc7af8e6f3b7d839

    9e6889b1445e30d9d28849cbffed5a3123408646

    cca7187d5cbf31b3e785f21309bb60b9247a4fb4

    562d8360854005e90ae316c1350b9660ffd3e6f9

    da997eeb64a3879af819c5cdda3aa5a236c55a25

    413e1c8661ec11fc8e7f9a7caccfc9c54cb1ea3d

    c8f5abb80e9c936d6bd5da99c10e829cde69a8f5

    20068b91036145b3e1b1d7e294b7a2f5ba26bd7f

    b164a1bf2c7b478ce040e479377526c00885ab7f

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection           

    Detection Query 1 :

    domainname like "kenobuias.com" or url like "kenobuias.com" or siteurl like "kenobuias.com" or domainname like "oscofneuid.com" or url like "oscofneuid.com" or siteurl like "oscofneuid.com"

    Detection Query 2 :

    sha1hash IN ("746dc75b1b887812db37b3801e104d887b2c8707","c8f5abb80e9c936d6bd5da99c10e829cde69a8f5","ace41996dc5b7ecdb68c2222fc7af8e6f3b7d839","b9e84889c9760460f53c9b49cb43a636bb721d28","6a37c3d4beb80ae1689dbbedcb53a86f85c8e44a","9e6889b1445e30d9d28849cbffed5a3123408646","da997eeb64a3879af819c5cdda3aa5a236c55a25","20068b91036145b3e1b1d7e294b7a2f5ba26bd7f","413e1c8661ec11fc8e7f9a7caccfc9c54cb1ea3d","c9258f527fe447431ff983aa76866e340db98e60","b164a1bf2c7b478ce040e479377526c00885ab7f","0d83344fee8973165e5009768c1752095a57f3c1","8531fe2db41e9e08525080be6d3e8092c5ffa5f8","2b5eeabbc52a25172123c2e7789c977e6bb557af","562d8360854005e90ae316c1350b9660ffd3e6f9","cca7187d5cbf31b3e785f21309bb60b9247a4fb4","d7b4d33c38deb0978b71ef79ff4df9fb90118cc2","3a1f9060dad56cd08e87fcafa2c87b99295b3db3","fd4a2c02ab5a99b5420538c8b1bfef6fa4fbd7fe")

    Reference:   

    Mirax Android RAT Targets Banking Customers Across META Region                                                                        


    Tags

    MalwareStealerRATMaaSKeyloggerWebSocketCredential HarvestingIndiaFinancial ServicesAndroid Malware

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.