Mirax in Malaysia: How This Android Remote Access Trojan Actually Attacks

Mirax malware is an Android remote access trojan and banking trojan that appeared on underground forums in December 2025 and moved quickly. Researchers have tracked live campaigns since March 2026, reaching more than 220,000 accounts, and the family has now become a concern for Malaysian financial institutions.

Most coverage of Mirax malware stops at the label: banking trojan, overlays, accessibility abuse. That description fits fifty other families and explains nothing about why this one succeeds. What follows is the mechanics, starting with a case we observed locally.

What Mirax Malware Looked Like in Malaysia

The internationally documented campaigns lure victims with streaming and IPTV applications. The version that reached Malaysian consumers was localised, and the change is instructive.

The localisation matters strategically. Swapping an IPTV lure for cheap consumer goods, and adding a live voice call, is not a technical change to Mirax malware. It is an affiliate reading a market and adjusting the social engineering. The payload underneath is the same, which is why defending against the lure is the wrong layer to defend at.

Banking Trojan or Remote Access Trojan?

Mirax malware is described as both, and the overlap is the point rather than a labelling problem.

A banking trojan is defined by its objective: stealing credentials and money from financial applications, classically through overlays and keylogging. A remote access trojan is defined by its capability: giving an operator live control of the device.

Older banking malware stole credentials and used them elsewhere, which left a trail your systems could recognise. A new device, an unfamiliar location, a session that did not look like the customer. Combining the two removes that trail entirely.

What Makes Mirax Malware Different

It is a private malware-as-a-service. Access is restricted to a small pool of vetted affiliates rather than sold openly, advertised at around 2,500 US dollars for a three-month subscription and 1,750 US dollars monthly for a reduced variant. Fewer operators means more deliberate targeting and longer periods of activity before a family attracts attention.

Its target list is server-side. Researchers have identified overlay templates for 182 applications and counting, loaded dynamically from the attacker’s infrastructure. Adding an institution is a content update, not a new build.

It turns the handset into infrastructure. An integrated SOCKS5 proxy module routes attacker traffic through the victim’s phone, so that traffic reaches your systems from a genuine residential IP in the correct country.

Stage One: Delivery Through Paid Advertising

The Mirax malware campaigns observed to date do not rely on obscure corners of the internet. They rely on advertising.

Internationally, ads placed on Meta platforms have promoted streaming and IPTV applications, frequently pitched around sports content. In the Malaysian case above, the same channel carried a consumer goods offer instead. The audience targeting is the attacker’s in both versions, which means the lure can be aimed at a demographic rather than sprayed.

The landing page serves an APK hosted on GitHub Releases. Two properties matter here. The domain is one that reputation systems and corporate filtering treat as legitimate, and the file hashes rotate frequently, so hash-based blocklists trail behind the campaign rather than blocking it.

The user is then prompted to permit installation from an unknown source, and does, because they asked for this app or because someone is on the phone telling them to.

Stage Two: The Dropper and the Payload

What installs first is not the trojan itself. It is a dropper, and the separation is deliberate.

The dropper carries a minimal permission set and little malicious behaviour, which is what allows it to pass casual inspection and automated analysis. The real payload is concealed, encrypted, and loaded dynamically after installation. Commercial packers and crypters are applied to the package, adding a further layer against static analysis.

The result is that the artefact a scanner examines and the artefact that attacks your customer are not the same thing. This is now standard practice across the category and it is the reason store review and file-based scanning both under-perform against it.

Stage Three: The Accessibility Prompt

This is the hinge of the entire attack, and it is worth being precise about how ordinary it looks.

The app presents a request to enable accessibility services, framed as a requirement for the thing the user came for. The user is walked through a legitimate Android settings screen and grants a legitimate permission. No vulnerability is exploited. Nothing is bypassed.

What that permission hands over is the ability to read the contents of any screen, and to perform taps and input as though the user had made them. That is what converts Mirax malware into a working remote access trojan in practical terms, because reading and acting are exactly what remote control requires. A live caller guiding the victim through the prompt, as in the Malaysian case, removes the last point at which hesitation might occur.

Stage Four: Command and Control

Once established, Mirax opens persistent WebSocket connections to its command infrastructure, separating control traffic, data and streaming, and the proxy tunnel across concurrent channels.

Two consequences follow. The malware maintains an interactive session rather than polling on a schedule, so an operator works in real time. And because the channels are separate, heavy activity such as screen streaming does not interfere with control, which is what makes live remote operation practical rather than clumsy.

This is the difference between malware that collects and a remote access trojan that is driven. One sends you data later. The other has someone at the other end of it now.

Stage Five: Mirax Malware Capabilities, and Why Your App Never Sees Them

Why Existing Controls Report Nothing

Your API gateway sees a well-formed, correctly authenticated request. Nothing in it is anomalous.

Your fraud engine reads device, location and session signals that are all genuine, because they are.

Multi-factor authentication completes successfully. The code was intercepted, and the notification suppressed.

Behavioural biometrics are weakened rather than defeated, but remote operation through accessibility produces input that is closer to human than scripted automation.

IP reputation passes, and this is the newer problem. Residential IP quality has been a dependable trust signal for years. The proxy module turns your own customers’ handsets into the thing that defeats it.

Store review never applied, because nothing was submitted to a store.

Customer education was built for a different attack. In the Malaysian case the victim was buying goods, not banking, and was being helped by a person they had chosen to call.

What Detects Mirax Malware

Signature detection will name Mirax, and that has real value for reporting and threat intelligence. It does nothing during the window before a signature ships, and nothing about the next variant an affiliate compiles.

What holds is detection of the conditions the attack requires, because those are fixed by how Android works rather than by any design choice the author can revise.

An accessibility service interacting with your sensitive screens. Stage three, evaluated at login, transfer and one-time password entry rather than only at launch.

An overlay window drawn above your views. The credential theft mechanism, observable at the moment it is attempted.

Screen capture or streaming during a transaction. Balances, statements and OTPs leaving the device.

Automated or synthetic interaction with your app. The signature of remote operation rather than a customer holding the phone.

Hooking, injection, virtualisation and debuggers. The evasion and control layer.

Integrity failure. Should an affiliate distribute a repackaged copy of your app rather than an overlay, a modified build that refuses to run closes that route.

None of this requires having seen Mirax malware before, and none of it depends on which product the advertisement was selling. A variant released next month, lured with something else entirely, still has to obtain accessibility, draw an overlay and read the screen.

The Regulatory Position in Malaysia

Malaysian banks moved on malware shielding for mobile banking through an industry-wide initiative driven by Bank Negara Malaysia, alongside the broader measures to combat financial scams. The expectation that a banking app detects a compromised device environment is established rather than emerging.

What an examiner asks now is narrower: what does your app detect beyond rooted devices, what does it do when a detection fires, and can you produce the log.

Where SecIron Fits

Conclusion

The Malaysian case is worth remembering for what it did not involve. No phishing link, no spoofed bank message, no suspicious download the customer went looking for. An advertisement for cheap goods, a phone call, and a series of reasonable-sounding instructions that ended with a remote access trojan on the device.

Lures are cheap to change and change constantly. The technical steps underneath do not: obtain accessibility, draw an overlay, read the screen, operate the session. Every stage after the third is invisible to controls positioned away from the device, which makes the question narrow and answerable.

If a customer granted accessibility to a malicious app tonight, and someone operated your banking app inside their session, would anything you own know?

Ready to meet your banking standards?

Talk to us about what your app currently detects while a session is being driven by someone else. We will assess your current release against the techniques this family uses and show you what hardening changes.

Contact us

Technical analysis of Mirax draws on published research by Cleafy Threat Intelligence and reporting by Infosecurity Magazine, SC Media, BankInfoSecurity and Security Affairs, together with the Malpedia malware family reference. Regulatory context from The Association of Banks in Malaysia. The Malaysian case described is based on SecIron’s own observations; affected institutions and individuals are not named, in line with our client confidentiality policy. Figures were current at the time of writing.