Criminals are using fake video-streaming apps to spread an Android banking trojan that takes over victims' phones and drains their bank accounts. Security firm Group-IB described the campaign, built around a remote-access trojan called Mirax, in research published on 5 November 2026.

Thousands of phones belonging to retail banking customers across the Middle East, Turkey and Africa were infected between March and September 2026, with activity surging during the Eid holidays and again in late July. Group-IB puts confirmed losses in the millions of dollars, based on its own telemetry and cases reported by affected banks, and warns the true figure is probably higher. The operation was still active when the research was published.

How the infection works

The chain starts inside low-reputation streaming apps available through Google Play. Adverts and video links inside those apps steer users to download a separate installer from outside the store. One confirmed dropper posed as 'TikTok 18+', an adult-themed imitation with no connection to TikTok. The payload then impersonates Google Play Services, swapping a Latin letter for a lookalike Cyrillic character, and pressures the victim to grant Android's Accessibility Service permission.

Full control of the phone

Once that permission is granted, Mirax can watch the screen, steal banking passwords, intercept one-time passcodes and operate banking apps directly from the victim's phone. Group-IB found the campaign's servers carried phishing templates for more than 20 regional banking and wallet apps, alongside cryptocurrency exchanges, and traced stolen money to suspected mule accounts, including accounts in India. The researchers linked the samples through a shared build tag, 'aquafina'.