Malware

Mirax RAT

Mirax RAT, also tracked as Mirax Bot, is an emerging Android remote access Trojan first spotted in early March 2026 by Outpost24's KrakenLabs. It has targeted users in Spanish-speaking countries and is distributed through fraudulent advertisements on Meta-owned platforms including Facebook, Instagram, Messenger, and Threads. The attack chain uses Meta ads to lure victims to web pages hosting dropper apps, and GitHub has also been used to host malicious APKs. The infection flow is described as a sophisticated multi-stage operation designed for evasion, relying on social engineering to persuade users to allow installation from unknown sources and enable Android accessibility services, while masquerading behind video playback features.

Once installed, Mirax enables real-time interaction with infected Android devices and supports command execution, user activity monitoring, keystroke capture, theft of photos and other data, theft of lock screen details, credential theft via overlays placed over legitimate apps, and fake notifications that appear to come from legitimate applications. It can also convert compromised devices into residential proxy nodes, using SOCKS5 protocol support and Yamux multiplexing to establish proxy channels and expose victims' IP addresses.

Research cited in the content attributes reporting on Mirax to KrakenLabs and Cleafy. KrakenLabs observed Mirax Bot being advertised on illicit forums as a private malware-as-a-service offering. Cleafy assessed the operation as tightly controlled and limited to a small number of affiliates, with access reportedly favoring reputable Russian-speaking cybercriminals. Reported pricing included $2,500 for a three-month subscription, with a lower-feature variant offered at $1,750 per month. The operation also offered crypter options named Virbox and Golden Crypt.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.003Spearphishing via ServiceEvidence1

One of the malware's core features is the ability to inject malicious HTML/JS overlays over legitimate applications to steal credentials and other sensitive data from users.

Execution

2 techniques

T1204User ExecutionEvidence1

The application requires the user to enable installation from Unknown Sources to install the final implant.

T1574.006Dynamic Linker HijackingEvidence1

Mirax implements a multi-step unpacking flow that attempts to hide malicious code via .dex dynamic loading and obfuscation.

Persistence

1 technique

T1546.008Accessibility FeaturesEvidence1

the malware loads a WebView with a custom HTML page when Accessibility Services have been granted... When Accessibility services are enabled, the malware starts running in the background

Privilege Escalation

1 technique

T1546.008Accessibility FeaturesEvidence1

the malware loads a WebView with a custom HTML page when Accessibility Services have been granted... When Accessibility services are enabled, the malware starts running in the background

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

The dropper Android Package (APK) does not contain the malicious code in the code section. Instead, it holds an encrypted Dalvik Executable (.dex) file... loaded, and decrypted using RC4 and a hardcoded key.

T1027.013Encrypted/Encoded FileEvidence1

The payload is hidden inside a file with a valid asset extension, loaded, and decrypted using RC4 and a hardcoded key... This file is encrypted using XOR with a hardcoded key in BuildConfig

T1036MasqueradingEvidence1

The dropper disguises itself as an IPTV application... When the malware is installed, it masquerades as a video playback utility and prompts the user to enable Accessibility Settings.

T1574.006Dynamic Linker HijackingEvidence1

Mirax implements a multi-step unpacking flow that attempts to hide malicious code via .dex dynamic loading and obfuscation.

Collection

1 technique

T1113Screen CaptureEvidence1

Screen Capture & VNC : These commands allow the attacker to view the screen in real-time and control the device remotely.

Command and Control

2 techniques

T1090ProxyEvidence1

SOCKS5 Proxy : The malware also allows the operator to start a SOCKS5 proxy connection from the infected device and transform it into a residential proxy node.

T1219Remote Access ToolsEvidence1

Screen Capture & VNC : These commands allow the attacker to view the screen in real-time and control the device remotely.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Spyware & Data Exfiltration : The malware's capabilities include spyware modules that attempt to exfiltrate text data and camera images from the victim's device.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

govinfosecurityNews

Apr 14, 2026

Mirax RAT Targets Android Devices Through Meta Apps

Android remote access trojan distributed via fraudulent Meta ads and malicious dropper pages. It captures keystrokes, steals photos and other data including lock screen details, runs commands, monitors user activity, uses overlay pages to steal credentials, and can convert infected devices into residential proxy nodes using SOCKS5 and Yamux-supported proxy channels.

bank info securityNews

Apr 14, 2026

Mirax RAT Targets Android Devices Through Meta Apps

Android remote access trojan distributed via fraudulent Meta ads and malicious dropper pages. It can capture keystrokes, steal photos and other data including lock screen details, run commands, monitor user activity, use overlay pages to steal credentials, and convert infected devices into residential proxy nodes using SOCKS5 and Yamux-supported proxy channels.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Mirax RAT