New Mirax Android RAT Turns Infected Phones Into Residential Proxy Nodes

Mirax is a dual-purpose Android malware (MaaS) that both harvests banking credentials and turns infected devices into residential SOCKS5 proxy nodes using Yamux over WebSocket, enabling attackers to route malicious traffic through victims' real IPs. The campaign, observed by Cleafy beginning March 2026 and first advertised on underground forums in December 2025, spread via paid Meta ads and phishing sites impersonating IPTV/streaming services, reached hundreds of thousands of accounts, abuses Accessibility Services for persistence, and is marketed to a limited set of trusted affiliates to reduce detection.