Hackers Use Fake Streaming Apps to Spread Mirax Android Malware and Steal Bank Accounts

What happened

Estimated losses reach millions of dollars, although confirmed cases capture only part of the campaign’s impact. Researchers linked the infections through embedded campaign tags, aquafina and aquafina_all, observed across samples communicating with multiple command-and-control servers.

Server responses revealed targeting configurations covering more than 20 regional banking and wallet applications, alongside cryptocurrency exchanges. Evidence suggests advertisements and video links inside these apps redirect users to an externally downloaded dropper.

Hackers are using streaming app lures to distribute Mirax. This Android banking trojan lets operators remotely control victims’ phones and initiate fraudulent transfers. Google is an Internet and software company based in Mountain View.

The operation remained active when Group-IB published its November 5 investigation.

Android cyber security Cyber Security News 3 min.

The suspected delivery chain starts with low-reputation streaming applications available through Google Play. Importantly, researchers did not establish that the Mirax payload itself was distributed directly through Google Play.