Mirax Android RAT Turns Devices into SOCKS5 Proxies Reaching 220,000 via Meta Ads
Mirax is a new Android remote access trojan that has been seen actively targeting Spanish-speaking nations. Through Meta advertising, campaigns have reached over 220,000 users on Facebook, Instagram, Messenger, and Threads.
According to Italian online fraud protection company Cleafy, Mirax incorporates sophisticated Remote Access Trojan (RAT) capabilities, enabling threat actors to completely communicate with compromised devices in real time.
By transforming compromised devices into residential proxy nodes, Mirax increases its operational utility beyond conventional RAT behavior. It creates persistent proxy channels that enable attackers to route their traffic through the victim's actual IP address by utilizing Yamux multiplexing and SOCKS5 protocol support.
The initial informati...