New Mirax Android RAT Turns Infected Phones Into Residential Proxy Nodes

Cybersecuritynews •Tushar Subhra Dutta • April 14, 2026

A newly discovered Android malware called Mirax has been quietly circulating in underground criminal forums since late 2025, posing a growing threat to mobile users across Europe and beyond. What sets it apart from typical banking trojans is its dual purpose: it steals banking credentials while simultaneously converting infected phones into residential proxy nodes, giving […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Mirax Android RAT Transforms Infected Devices into Proxy Nodes Mirax, a newly identified Android Remote Access Trojan (RAT) and banking malware, has emerged as a significant threat, particularly in Spanish-speaking regions. It was first observed on underground forums in December 2025 and has been actively monitored since March 2026. Mirax operates under a restricted Malware-as-a-Service (MaaS) model, primarily targeting Russian-speaking affiliates. The malware's capabilities include turning infected devices into residential proxy nodes, allowing attackers to route malicious traffic through legitimate IP addresses. This functionality enhances the malware's monetization potential and expands its operational scope beyond financial theft. Distribution methods include fake IPTV applications and phishing websites, with over 200,000 accounts reportedly reached through Meta Ads. The malware can execute commands, monitor user activity, and deploy fake overlays to steal sensitive information. As Mirax continues to spread, its impact is expected to grow, prompting cybersecurity experts to issue warnings about its evolving tactics. 9 sources 71

Extracted Entities

New Mirax Android RAT Turns Infected Phones Into Residential Proxy Nodes

The full story

Extracted Entities

Attack Types (2)

Malware (1)

Platforms (1)