[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOUxuGPd4PO-V-ws-8t6902KETPahorPPDAP6DiRyxtA":3},{"article":4,"iocs":44,"watch_terms":57,"solutions":58,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"22cb48eb-5346-4533-bb62-2ceb87b58db6","Mirax Android RAT Turns Devices into SOCKS5 Proxies, Reaching 220,000 via Meta Ads","mirax-android-rat-turns-devices-into-socks5-proxies-reaching-220-000-via-meta-ad-5619cd","A nascent Android remote access trojan called Mirax has been observed actively targeting Spanish-speaking countries, with campaigns reaching more than 220,000 accounts on Facebook, Instagram, Messenger, and Threads through advertisements on Meta. \"Mirax integrates advanced Remote Access Trojan (RAT) capabilities, allowing threat actors to fully interact with compromised devices in real","Mirax is a nascent Android remote access trojan actively targeting Spanish-speaking countries through Meta advertisements, reaching over 220,000 accounts across Facebook, Instagram, Messenger, and Threads. Beyond standard RAT capabilities like keystroke logging and credential theft, Mirax uniquely functions as a residential proxy botnet using SOCKS5 protocol, allowing attackers to route traffic through victim devices for fraud evasion and anonymity. The malware is distributed via dropper apps masquerading as streaming services and video players, with access prioritized for Russian-speaking actors in underground communities.","Mirax Android RAT reaches 220,000 users via Meta ads, turns devices into SOCKS5 proxies.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F04\u002Fmirax-android-rat-turns-devices-into.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgSTMJQqqJsKQgPpv94bO9xAc_tQCEJXJrZGAEmCuyUghslqHdHDYmuVYqIVLGqMLi_ZuY_zEBoDdGDQRVAX0KyGq9QcuIzQ5LVbNLBnwUwW2R7IBg0gopxAI9ml44zJsKXEoc1ig8zRbVDBNK3B4LZRE0WljzIfwnSMHx8Mv1kWYTK5qnxOB1YYl_WNWMa\u002Fs1600\u002Fandroid-malware.jpg","2026-04-14T10:20:00+00:00","2026-04-14T12:00:07.395345+00:00",9,[17,20,23,25,28,31],{"name":18,"type":19},"Mirax Bot","threat_actor",{"name":21,"type":22},"Cleafy","vendor",{"name":24,"type":22},"Outpost24",{"name":26,"type":27},"SOCKS5","technology",{"name":29,"type":30},"Google Play Protect","product",{"name":32,"type":27},"Yamux multiplexing","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":33,"icon":35,"name":36,"slug":37},null,"Malware","malware",[39],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,48,51,54],{"type":37,"value":46,"context":47},"Mirax","Android RAT with SOCKS5 proxy capabilities, MaaS offering priced at $2,500\u002F3 months or $1,750\u002Fmonth",{"type":37,"value":49,"context":50},"StreamTV","Dropper app package names: org.lgvvfj.pluscqpuj, org.dawme.secure5ny",{"type":37,"value":52,"context":53},"Reproductor de video","Dropper app package names: org.yjeiwd.plusdc71, org.azgaw.managergst1d",{"type":37,"value":55,"context":56},"ASO RAT","Arabic-language Android RAT distributed via PDF reader and Syrian government app lures",[21,24,29],{"controls":59,"vendors":144},[60,89,118],{"slug":61,"name":62,"problem":63,"products":64},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":90,"name":91,"problem":92,"products":93},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":119,"name":120,"problem":121,"products":122},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[123,128,136],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":124,"product_name":125,"url":126,"description":127},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",[145],{"slug":146,"name":24,"logo_path":147,"roles":148},"outpost24","\u002Fvendor-logos\u002Foutpost24.png",[149],"reported_by",{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":160},"mirax-android-rat-exploits-user-trust-and-device-configuration-weaknesses","Mirax Android RAT Exploits User Trust and Device Configuration Weaknesses","The Mirax Android RAT successfully compromised over 220,000 devices by exploiting user trust through legitimate-appearing Meta advertisements and fake streaming apps. Users unknowingly installed malware disguised as popular entertainment applications, demonstrating how social engineering combined with inadequate app verification can lead to massive infections. Beyond typical RAT functionality, Mirax transforms victim devices into SOCKS5 proxy nodes, enabling attackers to route malicious traffic through legitimate residential IP addresses to evade detection and conduct fraud.",[155,156,157,158,159],"CIS Control 7","CIS Control 12","NIST SP 800-124","NIST CM-11","OWASP Mobile Top 10",{}]