Mirax Android RAT Weaponizes Meta Ads to Build Global Proxy Botnet

The Mirax Menace: How a New Android RAT Weaponizes Meta Ads to Build a Global Proxy Army

Security researchers are sounding the alarm over a rapidly spreading Android Remote Access Trojan (RAT) campaign that is leveraging a disturbingly effective distribution channel: legitimate advertising on Meta's platforms. Dubbed "Mirax," this malware has already infected an estimated 220,000 devices worldwide, not to steal banking credentials directly, but to conscript them into a sprawling, global SOCKS5 proxy network—a botnet-for-hire infrastructure with serious implications for the cybersecurity landscape.

Infection Vector: Malvertising on a Grand Scale

The initial infection begins with a classic social engineering ploy, supercharged by Meta's sophisticated ad-targeting capabilities. Users are presented with compelling advertisements on Facebook or Instagram, promoting cracked versions of popular paid software, fake gaming cheats, or seemingly legitimate utility apps. These ads redirect to third-party websites hosting the malicious APK file, often disguised with convincing fake user reviews and professional-looking screenshots. The use of a trusted advertising platform lends an air of legitimacy that dramatically increases the click-through and installation rate compared to traditional phishing or shady download sites.

Technical Capabilities: Silent Enslavement

Once installed, Mirax requests extensive permissions, often hiding its icon to avoid detection. Its core functionality is to establish a persistent connection to a Command-and-Control (C2) server. Upon check-in, the infected device is configured as a SOCKS5 proxy node. SOCKS5 is a standard internet protocol that routes network packets between a client and a server through a proxy server, effectively masking the original source of the traffic.

From the user's perspective, the device may show slightly reduced battery life or increased data usage, but otherwise functions normally. In the background, however, it has become a cog in a massive anonymization machine. The botnet's operators can then sell access to this proxy network on underground forums to other cybercriminals, who use it for a range of illicit activities:

• Credential Stuffing & Account Takeovers: Launching attacks from thousands of different, legitimate residential IP addresses makes blocking attempts based on geographic or IP reputation nearly impossible.
• Ad Fraud: Generating fake clicks and impressions on pay-per-click advertising from real devices to siphon marketing budgets.
• Anonymized Attacks: Hiding the origin of attacks against websites, APIs, or rival criminal enterprises.
• Data Scraping: Bypassing rate limits and IP-based blocks to harvest data from e-commerce and social media sites.

The Bigger Picture: Evolution of Mobile Threats

The Mirax campaign marks a strategic pivot in mobile malware economics. Instead of the high-risk, high-reward model of direct bank fraud—which triggers rapid response from financial institutions and law enforcement—this model creates a steady, recurring revenue stream by building infrastructure. The infected devices become a commodity. This "proxy-as-a-service" model is lower profile and more sustainable for threat actors.

Parallel Threat: The Rise of NFC-Based Fraud

While Mirax builds infrastructure, other threat actors are refining techniques for direct financial theft. Notably, in Russia, security agencies and news outlets like MK.ru and Iz.ru are reporting a sharp increase in NFC-based payment fraud. In this scheme, attackers use social engineering—often posing as bank security officers, pollsters, or charity workers—to trick victims into unlocking their smartphone and bringing it near a concealed portable payment terminal with NFC capabilities.

Once in close proximity (a few centimeters), the attacker can initiate a contactless transaction from the victim's phone to their own account. The scam exploits the convenience of tap-to-pay systems, turning a moment of proximity into a significant financial loss. This threat, while currently concentrated in a specific region, demonstrates the creative ways attackers are exploiting standard mobile hardware features.

Mitigation and Defense Strategies

For enterprises, the Mirax botnet poses a direct threat if employees' mobile devices become infected and are used to access corporate resources, potentially bypassing network security controls based on IP trust. For individuals, it represents a violation of privacy and resource theft.

Recommendations include:

1. Vigilance with Ads: Treat advertisements for "cracked" software, too-good-to-be-true deals, or unofficial app versions with extreme skepticism, regardless of the platform they appear on.
2. Stick to Official Stores: Only install applications from the Google Play Store, and even then, scrutinize developer profiles, reviews, and requested permissions.
3. Monitor Device Behavior: Unexplained data usage, battery drain, or device overheating can be indicators of malicious background activity.
4. Keep Software Updated: Ensure your Android OS and all apps are updated to patch known vulnerabilities malware might exploit.
5. Use Reputable Security Software: A good mobile security solution can help detect and block RATs and other malicious payloads.
6. NFC Awareness: Be cautious with unsolicited requests to bring your phone near another device. Disable NFC when not in use, especially in crowded or high-risk environments.

Conclusion

The convergence of the Mirax proxy botnet and NFC fraud schemes paints a clear picture of the modern mobile threat landscape. Attackers are operating with business-like efficiency, specializing in either long-term infrastructure building or quick-financial-hit operations. They leverage the most trusted platforms (social media ads) and the most convenient features (contactless payments) as weapons. For the cybersecurity community, this underscores the need for defense-in-depth that goes beyond traditional perimeter security, emphasizing user education, behavioral monitoring, and a zero-trust approach to network access—even from seemingly legitimate IP addresses. The device in your pocket is no longer just a communication tool; in the wrong hands, it can become a weapon or a resource against the wider digital ecosystem.