Mirax Android RAT Turns Devices into SOCKS5 Proxies, Reaching 220,000 via Meta Ads
Mirax Android RAT reaches 220,000 users via Meta ads, turns devices into SOCKS5 proxies.
Mirax is a nascent Android remote access trojan actively targeting Spanish-speaking countries through Meta advertisements, reaching over 220,000 accounts across Facebook, Instagram, Messenger, and Threads. Beyond standard RAT capabilities like keystroke logging and credential theft, Mirax uniquely functions as a residential proxy botnet using SOCKS5 protocol, allowing attackers to route traffic through victim devices for fraud evasion and anonymity. The malware is distributed via dropper apps masquerading as streaming services and video players, with access prioritized for Russian-speaking actors in underground communities.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Cleafy?
Get an email when a new story names Cleafy, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Mirax Android RAT successfully compromised over 220,000 devices by exploiting user trust through legitimate-appearing Meta advertisements and fake streaming apps. Users unknowingly installed malware disguised as popular entertainment applications, demonstrating how social engineering combined with inadequate app verification can lead to massive infections. Beyond typical RAT functionality, Mirax transforms victim devices into SOCKS5 proxy nodes, enabling attackers to route malicious traffic through legitimate residential IP addresses to evade detection and conduct fraud.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Mirax
- malware — StreamTV
- malware — Reproductor de video
- malware — ASO RAT