Cybercrime as-a-service
,
Endpoint Security
,
Fraud Management & Cybercrime
Malware-as-a-Service Operations Favors Russian-Speaking Customers
An emerging remote access Trojan targeting Android devices in Spanish-speaking nations is propagating fraudulent advertisements as an initial access point on Meta-owned applications.
See Also: Panel | Cyberattacks Are Increasing — And Cyber Insurance Rates Are Skyrocketing
First spotted in early March by Outpost24’s KrakenLabs, Mirax and its advanced capabilities allow threat actors to interact with devices in real time, compromising and converting them into residential proxy nodes through Facebook, Instagram, Messenger or Threads ads. The RAT is localized to Meta-operated platforms, “relying on SOCKS5 protocol support and Yamux multiplexing” to establish proxy channels and uncover a victim’s IP address, according to new research from online fraud prevention firm Cleafy.
Mirax – also tracked as Mirax Bot – is capable of capturing keystrokes, stealing photos or data, including lock screen details, running commands and monitoring user activity. It uses overlay pages over legitimate apps to steal credentials or display notifications coming from apps. The malware is distributed through attack chains that use Meta ads to promote dropper app web pages, tricking unsuspecting users into downloading them.
While Meta and its corresponding platforms serve as the RAT’s primary access point, Mirax also utilizes GitHub as a malicious APK file dropper, offering two options of crypters – Virbox or Golden Crypt.
After installation, a dropper deploys malware by prompting users to allow for installation from an “unknown source,” resulting in a “sophisticated, multi-stage operation” designed for evasion. The malware masquerades behind video playback features, further prompting the victim to enable accessibility services that open the door to Mirax.
KrakenLabs observed a threat actor under the Mirax Bot name offering a private malware-as-a-service campaign on illicit forums, starting at $2,500 for three month subscriptions and $1,750 per month for a variant version with fewer features.
Cleafy researchers said the MaaS offering is “highly controlled” and “exclusive” to a small number of affiliates. “Access appears to be prioritized for Russian-speaking actors with established reputations in underground communities, indicating a deliberate effort to maintain operational security and campaign effectiveness,” said the firm.