New Android Malware Recruits Phones as Residential Proxies in Stealth Campaign

**Mirax** is an Android Remote Access Trojan and banking malware distributed via malicious Meta ads and fake IPTV apps that has been observed in March 2026 targeting Spanish-speaking users; it abuses Accessibility, uses packed droppers on GitHub, maintains persistence and C2 over WebSockets (ports 8443–8445), and provides capabilities for overlays, VNC/control, UI automation, data exfiltration, and SOCKS5 proxying for potential botnet/proxy abuse.