An alarming new campaign is leveraging streaming app advertisements on Android devices to harvest banking credentials and siphon funds from users’ accounts. The malware, identified as Mirax, allows cybercriminals to control infected devices, intercept security codes, and directly manipulate banking applications.
Impact on Middle East, Turkey, and Africa
The malware campaign targeted Android users across the Middle East, Turkey, and Africa between March and September 2026. During this period, thousands of devices were compromised, leading to significant financial losses. Although exact figures are difficult to ascertain, confirmed cases have resulted in losses amounting to millions of dollars. These figures reflect only the fraud that has been detected and investigated.
Group-IB’s investigation into the malware campaign, published on November 5, highlighted peaks in activity during the Eid celebrations and late July. Despite the publication of these findings, the operation was still ongoing, with the suspected streaming apps available on Google Play.
How the Malware Operates
The attack begins when users download streaming apps with low reputations from Google Play. These apps serve as a conduit for malicious advertisements, which redirect users to download a separate installer from outside the official app store. This method differs from previous attacks that used fake IPTV apps distributed via sideloading.
One notable installer was disguised as ‘TikTok 18+,’ a fake app unrelated to TikTok or its parent company, ByteDance. This installer fetches the Mirax payload, which masquerades as a legitimate Google Play Services component by using a Cyrillic letter that resembles the Latin ‘o.’ This disguise allows it to request dangerous permissions under the guise of a familiar system component.
Advanced Tactics and Recommendations
Once installed, Mirax requests accessibility permissions, allowing it to read screen content and control the device interface. This enables the malware to overlay fake banking login screens over legitimate apps, capturing user credentials in the process. It also intercepts SMS messages and notifications, records typed information, and captures lock-screen security patterns.
Mirax’s capabilities extend beyond credential theft. It can replay captured information to initiate unauthorized banking transactions, often erasing the usual security signals that might alert a bank’s systems. Evidence suggests that some of the stolen funds were transferred internationally or moved through marketplace purchases, complicating the tracing efforts.
Experts recommend that users reject unexpected permissions from entertainment apps and avoid downloading advertised APKs. Banks should monitor for unusual permissions and remote-control activities, and escalate any suspicious transactions for further verification. Moreover, behavioral detection is crucial as indicators of compromise frequently rotate.
Organizations are urged to integrate threat intelligence into their security operations centers to swiftly respond to and mitigate incidents. The control over compromised devices that Mirax provides highlights the need for vigilant monitoring and a rapid response to potential threats.
