[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLgBLe9NJgd-QtIg3uvM-G2Zy_b_RO3_P38qmJh3D2G0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"f69ae99a-9ef8-48f2-be95-25a3aab7663c","android-banking-malware-abuses-accessibility-services-to-steal-funds","8d800714-1a7b-4f65-ba43-648224627a4e","Android Banking Malware Abuses Accessibility Services to Steal Funds","The Mirax malware campaign exploits a critical gap in user security awareness: victims are socially engineered through streaming app advertisements into sideloading an APK from outside the official Google Play Store. Once installed, the malware requests Accessibility Services permissions, which grant it sweeping control over the device — including reading screen content, intercepting SMS-based verification codes, and autonomously operating banking applications. This attack succeeds not because of a software vulnerability in banking apps, but because users unknowingly hand over device control by granting excessive permissions to an untrusted app. The result is direct financial fraud, with millions of dollars lost across the Middle East, Türkiye, and Africa. Organizations and individuals must understand that sideloading apps and blindly granting sensitive permissions are high-risk behaviors with severe financial consequences.","**Immediate actions:**\n- Never install apps from outside official app stores (Google Play or Apple App Store), especially when prompted through advertisements in third-party streaming apps.\n- Review and revoke Accessibility Services permissions on personal and corporate devices for any app that does not explicitly require them for legitimate assistive purposes.\n- Enable Google Play Protect on all Android devices to scan for and block known malicious APKs.\n\n**Long-term improvements:**\n- Deploy a Mobile Device Management (MDM) solution to enforce policies that block sideloading and restrict installation of apps from unknown sources on corporate and BYOD devices.\n- Implement app allowlisting policies so only approved applications can be installed and granted sensitive permissions on managed devices.\n- Conduct regular security awareness training that specifically covers mobile threats, the dangers of sideloading, and how to identify social engineering via advertisements.\n\n**Detection measures:**\n- Monitor banking transaction anomalies and implement behavioral analytics to flag unusual login patterns or fund transfers that may indicate remote device control.\n- Establish an incident response playbook specifically for mobile banking malware, including steps for rapid account freezing and device quarantine.",[12,13,14,15,16],"MITRE ATT&CK T1626: Abuse Elevation Control Mechanism: Accessibility Features","NIS2 Article 21(2)(g)","CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIS2 Article 21(2)(j)","NIST SP 800-53 SI-3: Malicious Code Protection",{"NIS2 Article 21(2)(g)":18,"NIS2 Article 21(2)(j)":19,"NIST SP 800-53 SI-3: Malicious Code Protection":20,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":21,"MITRE ATT&CK T1626: Abuse Elevation Control Mechanism: Accessibility Features":22},"This incident succeeded because end users lacked basic cyber hygiene knowledge about the risks of sideloading apps and granting Accessibility Services permissions, which mandatory hygiene and training programs would directly address.","The malware intercepts SMS-based one-time passwords used as a second authentication factor; requiring app-based or hardware MFA instead of SMS would have limited the attacker's ability to bypass verification controls.","Deploying and enforcing mobile endpoint protection (such as Google Play Protect or an MDM-enforced security agent) that detects and blocks malicious APKs before execution is what this control requires and would have prevented the malware from running.","Enforcing a secure configuration policy that disables installation from unknown sources and restricts Accessibility Services permissions on managed Android devices would have blocked the malware's installation and permission abuse.","Mirax directly abuses Android Accessibility Services to gain elevated control over device functions, including remote operation of banking apps and credential capture, which is precisely what this technique describes.","published","2026-11-10T14:20:43.560817+00:00","2026-11-10T14:20:43.525+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fcybersecuritynews.com\u002Fnew-mirax-android-malware\u002F","new-mirax-android-malware-uses-accessibility-services-to-remotely-control-phones-92fc33","New Mirax Android Malware Uses Accessibility Services to Remotely Control Phones and Steal Bank Funds",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[45,49,53],{"slug":46,"name":47,"problem":48},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":50,"name":51,"problem":52},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":54,"name":55,"problem":56},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]