Six Android Malware Families Target Pix Payments, Banking Apps, and Crypto Wallets

**Executive summary:** Cybersecurity researchers identified multiple Android malware families (PixRevolution, TaxiSpy RAT, BeatBanker, Mirax, Oblivion RAT, SURXRAT, BTMOB) being distributed via fake Google Play Store pages and phishing; these samples abuse Android accessibility and MediaProjection APIs, use overlays to hijack Pix and cryptocurrency transfers, exfiltrate credentials and device data, include crypto-miners and remote administration features, are marketed as MaaS on Telegram and other forums, and show experimentation with LLM components and ransomware-style screen lockers.