Cybersecurity researchers at Cleafy have uncovered Mirax, a sophisticated Android Remote Access Trojan (RAT) and banking malware that’s shaking up underground cybercrime.
First advertised on dark web forums in December 2025, Mirax came to light in March 2026 through campaigns targeting Spanish-speaking users.
Unlike open Malware-as-a-Service (MaaS) tools, Mirax runs an exclusive club limited to vetted Russian-speaking affiliates. This tight control boosts its stealth and success rate.
How Mirax Sneaks In and Sets Up
Attackers push Mirax via Meta ads on Facebook and Instagram, luring victims with fake IPTV apps for sports streaming. These ads reached over 200,000 accounts, mostly in Spain.
Landing pages check for mobile browsers via HTTP headers, blocking scanners. Droppers host on GitHub Releases, with daily hash swaps, but the same code to evade detection.
Once installed, the dropper packed with Golden Encryption (GoldCrypt) unpacks via WebSockets. It hides an encrypted .dex file in a nested, obfuscated folder path.
RC4 decryption with a hardcoded key reveals the payload, which XOR-unpacks the final APK from res/raw/. No remote downloads in tested samples, but builder docs hint at it.
Post-install, Mirax poses as a video player. It nags for Accessibility Services, then flashes fake HTML error pages and black overlays to lock the screen.
Persistence kicks in, phoning home via three WebSockets: port 8443 for commands, 8444 for data exfil, and 8445 for proxy tunneling over Yamux multiplexing.
Deep Dive: Code, Commands, and Proxy Power
Mirax’s builder offers Virbox or GoldCrypt packing, plus custom WebView HTML for overlays.
It targets 182 apps, including Spanish banks and crypto wallets templates push dynamically from C2 a shared “gate” server proxies traffic, hiding real C2S.
Key commands include:
- Overlays and notifications: Steal creds via injected HTML/JS.
- VNC and screen grabs: Real-time spying and control.
- UI automation: Swipe, tap via Accessibility.
- App control: Kill security apps.
- Exfil: Texts, SMS, camera snaps.
- SOCKS5 proxy: Turns phone into an exit node.
The proxy shines in partial infections if users skip Accessibility, attackers still get bandwidth for IP spoofing, DDoS, or spraying attacks.
C2 uses bidirectional WebSockets; devices heartbeat status, servers push configs. Docs note CIS country blocks due to app limits.
According to Cleafy research, this proxy-in-RAT combo exploits Android’s vast, insecure ecosystem think cheap TVs and sideloaded apps.
Past proxy bots hit IoT; Mirax elevates it to the level of premium banking malware. No active proxy use seen yet, but pricing tiers scream future botnet sales.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 and banking malware that's shaking up underground cybercrime.){kind=link}