Group-IB says an ongoing campaign using the Mirax Android remote-access trojan infected thousands of phones belonging to retail banking customers across the Middle East, Turkey and Africa region. In a report published on November 5, 2026, the security firm said the infections were recorded between March and September, with the operation still active when its research was released.
Group-IB estimates that the campaign caused losses in the millions of dollars through unauthorized international transfers. The estimate is based on the firm’s telemetry and cases confirmed by affected banks; the company said the real total may be higher because it cannot see every infected device or unreported loss.
The infection chain begins with low-reputation video-streaming apps that serve advertisements. Group-IB said some of those ads led users to a separate dropper downloaded outside Google Play, which then installed the Mirax payload. One dropper observed during the investigation posed as an adult version of TikTok, but it was not affiliated with the official service.
After installation, Mirax impersonates Google Play Services and pressures victims to grant Android’s Accessibility Service permission. That access allows the malware operator to view and control the device, read credentials, intercept one-time codes from SMS and notifications, capture the screen-lock PIN, and interact with banking apps using the victim’s own session.
Group-IB found that the campaign’s command-and-control servers supplied phishing and HTML overlay templates for more than 20 banks and digital wallets in the region, along with a small number of global cryptocurrency exchanges. Because those templates and target-app mappings are delivered remotely, operators can change which financial services are targeted without rebuilding the installed malware.
The researchers grouped the samples under the Aquafina campaign after finding a shared build tag across multiple command-and-control servers. Group-IB said the activity remained ongoing at the time of publication, and that victims had reported unauthorized transfers from their own devices to accounts abroad, some of which were suspected mule accounts.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
