[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhoDlozJt8jigaebvmbTScLBTnBhizLIoXINDa57H-A4":3},{"article":4,"iocs":40,"watch_terms":44,"solutions":45,"lesson":126},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"8d800714-1a7b-4f65-ba43-648224627a4e","New Mirax Android Malware Uses Accessibility Services to Remotely Control Phones and Steal Bank Funds","new-mirax-android-malware-uses-accessibility-services-to-remotely-control-phones-92fc33","An Android banking malware campaign is using advertisements inside streaming apps to turn everyday phones into tools for financial theft. Mirax, the malware abuses Accessibility Services to watch screens, capture passwords, intercept verification codes, and let criminals operate banking apps directly on infected devices. Thousands of Android phones belonging to retail banking customers across the […] The post New Mirax Android Malware Uses Accessibility Services to Remotely Control Phones and Steal Bank Funds appeared first on Cyber Security News.","A new Android banking malware campaign named Mirax is infecting thousands of phones in the Middle East, Türkiye, and Africa. It abuses Accessibility Services to capture passwords, intercept verification codes, and remotely operate banking apps, leading to millions of US dollars in reported fraud. The malware is distributed through advertisements in streaming apps, directing users to install it outside the official Google Play store.","Mirax Android malware uses Accessibility Services to steal bank funds by remotely controlling phones.","https:\u002F\u002Fcybersecuritynews.com\u002Fnew-mirax-android-malware\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FNew-Mirax-Android-Malware-Uses-Accessibility-Services-to-Remotely-Control-Phones-and-Steal-Bank-Funds.webp","2026-11-10T13:54:17+00:00","2026-11-10T14:00:28.466518+00:00",8,[17,20,23,25],{"name":18,"type":19},"Google","vendor",{"name":21,"type":22},"Google Play Services","product",{"name":24,"type":22},"TikTok",{"name":26,"type":19},"ByteDance","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":27,"icon":29,"name":30,"slug":31},null,"Malware","malware",[33,35],{"category":34},{"id":27,"icon":29,"name":30,"slug":31},{"category":36},{"id":37,"icon":29,"name":38,"slug":39},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[41],{"type":31,"value":42,"context":43},"Mirax","Name of the Android banking malware campaign.",[18,26,21],{"controls":46,"vendors":125},[47,68,96],{"slug":48,"name":49,"problem":50,"products":51},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[52,60],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":39,"name":69,"problem":70,"products":71},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"slug":97,"name":98,"problem":99,"products":100},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",[],{"slug":127,"title":128,"body":129,"framework_refs":130,"framework_notes":136},"android-banking-malware-abuses-accessibility-services-to-steal-funds","Android Banking Malware Abuses Accessibility Services to Steal Funds","The Mirax malware campaign exploits a critical gap in user security awareness: victims are socially engineered through streaming app advertisements into sideloading an APK from outside the official Google Play Store. Once installed, the malware requests Accessibility Services permissions, which grant it sweeping control over the device — including reading screen content, intercepting SMS-based verification codes, and autonomously operating banking applications. This attack succeeds not because of a software vulnerability in banking apps, but because users unknowingly hand over device control by granting excessive permissions to an untrusted app. The result is direct financial fraud, with millions of dollars lost across the Middle East, Türkiye, and Africa. Organizations and individuals must understand that sideloading apps and blindly granting sensitive permissions are high-risk behaviors with severe financial consequences.",[131,132,133,134,135],"MITRE ATT&CK T1626: Abuse Elevation Control Mechanism: Accessibility Features","NIS2 Article 21(2)(g)","CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIS2 Article 21(2)(j)","NIST SP 800-53 SI-3: Malicious Code Protection",{"NIS2 Article 21(2)(g)":137,"NIS2 Article 21(2)(j)":138,"NIST SP 800-53 SI-3: Malicious Code Protection":139,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":140,"MITRE ATT&CK T1626: Abuse Elevation Control Mechanism: Accessibility Features":141},"This incident succeeded because end users lacked basic cyber hygiene knowledge about the risks of sideloading apps and granting Accessibility Services permissions, which mandatory hygiene and training programs would directly address.","The malware intercepts SMS-based one-time passwords used as a second authentication factor; requiring app-based or hardware MFA instead of SMS would have limited the attacker's ability to bypass verification controls.","Deploying and enforcing mobile endpoint protection (such as Google Play Protect or an MDM-enforced security agent) that detects and blocks malicious APKs before execution is what this control requires and would have prevented the malware from running.","Enforcing a secure configuration policy that disables installation from unknown sources and restricts Accessibility Services permissions on managed Android devices would have blocked the malware's installation and permission abuse.","Mirax directly abuses Android Accessibility Services to gain elevated control over device functions, including remote operation of banking apps and credential capture, which is precisely what this technique describes."]