A sophisticated new Android malware campaign has successfully compromised over 220,000 mobile devices, transforming them into a vast network of criminal proxy infrastructure. The Mirax remote access trojan represents a troubling evolution in mobile threats, combining traditional RAT capabilities with groundbreaking residential proxy functionality that enables cybercriminals to mask their activities through victims' IP addresses.
The Rise of Private Malware-as-a-Service
Unlike conventional malware distribution models, Mirax operates under a highly exclusive "private MaaS" framework. This restricted approach limits access to a carefully vetted group of affiliates, dramatically reducing the risk of exposure and extending the malware's operational lifespan. The strategy has proven remarkably effective, allowing the threat to remain active and undetected across multiple campaign cycles.
Security researchers first observed Mirax being promoted on underground cybercriminal forums in December 2025, with active campaigns primarily targeting Spanish-speaking populations beginning in March 2026. The focused geographic targeting suggests a calculated approach to maximize infection rates while minimizing detection by international security teams.
Meta Platforms Exploited for Mass Distribution
The attack chain begins with sophisticated social engineering campaigns leveraged through Meta's advertising ecosystem. Cybercriminals purchase legitimate advertisements on Facebook and Instagram, directing unsuspecting users to convincing phishing websites that offer enticing but illicit services, particularly illegal sports streaming applications.
These deceptive landing pages implement clever anti-analysis measures, restricting access exclusively to mobile devices to avoid detection by security researchers using desktop systems. The sites exploit users' familiarity with sideloading Android applications, a practice common among those seeking content unavailable through official app stores.
GitHub Weaponized as Malware Repository
The technical delivery mechanism demonstrates remarkable sophistication. Malicious payloads are hosted on GitHub Releases, leveraging the platform's reputation and infrastructure to avoid suspicion. The threat actors frequently update and repack their droppers to circumvent security scanning systems, while also reusing existing releases to minimize the creation of new, potentially flagged repositories.
Advanced Evasion Through Multi-Stage Infection
Mirax employs a complex two-stage infection process designed to circumvent both automated and manual analysis efforts. The initial dropper masquerades as a legitimate IPTV application, containing an encrypted .dex file buried deep within the application structure using obfuscated paths and uncommon naming conventions.
The decryption process utilizes RC4 encryption with hardcoded keys, revealing a secondary encrypted APK payload. This inner payload undergoes XOR decryption before installation, creating multiple layers of protection against reverse engineering attempts. The malware leverages advanced packers, including the widely-used Golden Encryption system popular in underground forums, to further complicate detection efforts.
Comprehensive Device Control and Data Theft
Once successfully installed, Mirax requests Android Accessibility permissions under the guise of video playback functionality. These permissions grant the malware extensive control over the infected device, enabling it to operate silently in the background while presenting fake error messages to maintain the illusion of a broken application.
The trojan's capabilities extend far beyond traditional RAT functionality:
Revolutionary SOCKS5 Proxy Integration
The most concerning innovation in Mirax is its ability to transform infected devices into residential SOCKS5 proxy nodes. This functionality creates a distributed network of legitimate IP addresses that cybercriminals can utilize to mask their activities during subsequent attacks. The residential nature of these proxies makes them particularly valuable for fraud operations, lateral movement within networks, and distributed denial-of-service campaigns.
Communication with command-and-control infrastructure occurs through WebSocket connections, enabling real-time control and data exfiltration while maintaining persistent connectivity for proxy operations. This dual-purpose design maximizes the value extracted from each compromised device.
Key Takeaways for Organizations
The Mirax campaign highlights critical vulnerabilities in mobile security ecosystems that organizations must address:
- Implement comprehensive mobile device management: Deploy solutions that monitor and control application installations across corporate devices
- Enhance user education: Train employees about the risks of sideloading applications and clicking on social media advertisements
- Monitor network traffic: Implement detection systems capable of identifying suspicious WebSocket connections and proxy traffic patterns
- Review social media policies: Establish clear guidelines for employee social media usage on corporate networks and devices
The evolution toward private MaaS models and residential proxy integration represents a significant escalation in mobile threat sophistication. Organizations must adapt their security strategies to address these advanced persistent threats that combine social engineering, legitimate platform abuse, and cutting-edge evasion techniques to achieve unprecedented scale and stealth.
