A remote access trojan called Mirax is taking over Android phones to steal banking passwords, intercept one-time passwords (OTPs), and carry out fraudulent transfers.

Thousands of infected devices among retail banking customers in the META region between March and September 2026. Activity peaked during the Eid holidays and again at the end of July.

The security company estimates losses in the millions of US dollars, based on its telemetry and confirmed cases reported by affected banks.

Researchers warned that the actual impact could be higher because unreported fraud and devices outside their visibility are not included. The campaign remained active when Group-IB published its findings on November 5.

Mirax RAT Hijacks Phones

The infection chain starts with low-reputation streaming or video apps available through Google Play. Evidence suggests advertisements and video links inside these apps direct users to download a dropper outside the official store.

That dropper then installs Mirax. One confirmed example used the name “Tiktok 18+,” falsely suggesting a connection to TikTok.

After installation, the payload impersonates “Google Play Services,” replacing a Latin letter with a similar-looking Cyrillic character. It then pressures users into granting Accessibility Service access, the central permission behind its device takeover capabilities.

With that access, attackers can monitor screens, record keystrokes, steal credentials, and intercept SMS messages and notifications containing OTPs.

Mirax also captures the device’s PIN, password, or unlock pattern, allowing operators to unlock the phone later without the victim’s involvement.

Operators can open banking apps and initiate transfers directly from the compromised phone. These transactions may appear legitimate because they originate from the customer’s usual device and banking session. Researchers identified suspected mule accounts in India among the destinations used to move stolen funds.

Mirax changes package names between builds, hides its launcher icon, and rotates visible app names. It can block uninstall screens and security apps while using black overlays or fake updating screens to conceal malicious activity. Android Broadcast Receivers help it resume operation after reboots and app restarts.

Its command-and-control infrastructure uses two WebSocket channels: one for commands and another for stolen data. An HTTP long-polling fallback provides another communication method.

Operators can remotely change connection settings, including hosts, ports, encryption parameters, and polling intervals. DNS-over-HTTPS conceals domain lookups from local DNS monitoring, group-ib said.

Indicators of Compromise

Android package name	SHA-1 hash	Reported installation date
net.wgrjvz.toolyt93a	b9e84889c9760460f53c9b49cb43a636bb721d28	August 6, 2026
org.xrmhvlfx.litewnj3h	8531fe2db41e9e08525080be6d3e8092c5ffa5f8	July 31, 2026

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team 

The post New Mirax Android RAT Takes Full Control of Phones to Steal Banking Passwords and OTPs appeared first on Cyber Security News.

Kaspersky researchers found a Storm-2603 attack on a SharePoint server that used ToolShell flaws to plant a fileless backdoor inside the IIS worker process (w3wp.exe). The implant ran entirely in memory. Later steps in the attack still left files on disk.

ToolShell is a chain of SharePoint flaws: CVE-2025-53770 and CVE-2025-53771 are the patch bypasses for CVE-2025-49704 and CVE-2025-49706.

The exploit sends a crafted request to the ToolPane.aspx endpoint. It bypasses authentication and runs code on the server.

Microsoft linked Storm-2603 to ransomware attacks that used these flaws. Other actors used them mainly for espionage and credential theft.

ToolShell Enables Fileless Backdoors

The attack ran in stages:

• Dec 20: A single request checked whether the server was vulnerable. It came from ONYPHE, an internet scanning platform that safely tests targets for specific CVEs. Because the request looked like routine scanning, defenders gave it low priority.
• Dec 21–23: Nothing happened. This gap made it harder to connect the probe to the later attack.

The webshell loads straight into the ASP.NET runtime. It stays active until the application pool recycles or IIS restarts.

Its main component, G.cs, registers a custom VirtualPathProvider. This lets the implant watch every request. It stays dormant unless a request carries a specific User-Agent.

It talks to the attacker over a custom binary protocol with XOR obfuscation. It also builds a TCP tunnel with the suo5 proxy tool, so the attacker can reach internal hosts through the SharePoint server.

A privilege escalation routine based on EfsPotato gives the implant SYSTEM rights.

After the webshell was in place, w3wp.exe launched msiexec.exe. It installed Velociraptor version 0.73.4.0, which is vulnerable to CVE-2025-6264, from Supabase storage.

Velociraptor is a legitimate forensics tool. The attackers used it to run commands. Cisco Talos had already tied this tactic to Storm-2603.

The attackers then added backup access through Zoho Assist, VS Code tunneling, and Cloudflare Tunnel. This let them stay in even if the ToolShell foothold was removed.

They also dropped a vulnerable driver (rsndispot.sys) and a DLL identified as Warlock ransomware’s antivirus killer. Kaspersky’s Proactive Defense Module blocked the ransomware launch. Kaspersky attributes the attack to Storm-2603 with moderate confidence.

Microsoft’s steps are to apply the latest SharePoint updates, enable AMSI in Full Mode, deploy Defender or an equivalent, rotate ASP.NET machine keys, and restart IIS. Preserve memory and IIS telemetry before restarting, because a restart erases the implant, securelist said.

Indicators of Compromise

Indicator	Type	Description
45.91.94[.]204	IP	SPN node (ToolShell exploitation source)
49.51.132[.]100	IP	SPN node

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team 

The post Hackers Exploit Microsoft SharePoint ToolShell Vulnerabilities to Deploy Fileless Backdoor That Hides in Memory appeared first on Cyber Security News.

Attackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to the server, an account name, and a password between 257 and 1,024 bytes long. OpenSSH, which rates the flaw critical, released version 10.6p2 today to block it. Alpine has published fixed packages for every

The FBI and CISA warn that hackers are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide, potentially causing food spoilage, equipment damage, and fire hazards. [...]

DigiCert warns it suffered a data breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorized access to customer information and identity documents. [...]

The trio, who have nicknames that include “Rocky Balboa,” “Superman Cash” and “Fat Boy,” often targeted the companies’ accounting departments.

The post 3 Charged in Scheme to Use AI to Impersonate CEOs and Attorneys to Steal $129 Million appeared first on SecurityWeek.