New Mirax Android Malware Uses Accessibility Services to Remotely Control Phones and Steal Bank Funds
Mirax Android malware uses Accessibility Services to steal bank funds by remotely controlling phones.
A new Android banking malware campaign named Mirax is infecting thousands of phones in the Middle East, Türkiye, and Africa. It abuses Accessibility Services to capture passwords, intercept verification codes, and remotely operate banking apps, leading to millions of US dollars in reported fraud. The malware is distributed through advertisements in streaming apps, directing users to install it outside the official Google Play store.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Mirax malware campaign exploits a critical gap in user security awareness: victims are socially engineered through streaming app advertisements into sideloading an APK from outside the official Google Play Store. Once installed, the malware requests Accessibility Services permissions, which grant it sweeping control over the device — including reading screen content, intercepting SMS-based verification codes, and autonomously operating banking applications. This attack succeeds not because of a software vulnerability in banking apps, but because users unknowingly hand over device control by granting excessive permissions to an untrusted app. The result is direct financial fraud, with millions of dollars lost across the Middle East, Türkiye, and Africa. Organizations and individuals must understand that sideloading apps and blindly granting sensitive permissions are high-risk behaviors with severe financial consequences.
What helps against this
How we list vendors- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Mirax