Mirax Android RAT Turns Devices into SOCKS5 Proxies, Reaching 220,000 via Meta Ads

Mirax is an Android RAT distributed via Meta ads to 220,000+ accounts, combining remote access with SOCKS5 proxy capabilities. - Offered as Malware-as-a-Service for $2,500/three months, targeting Spanish-speaking users. - Features keystroke capture, photo theft, credential-stealing overlays, and device command execution. - Converts infected devices into residential proxies via SOCKS5 to route traffic through victim IPs and evade detection. - Distributed through dropper apps (StreamTV, Reproductor de video) hosted on GitHub with multi-stage extraction. - Uses WebSocket C2 channels (8443, 8444, 8445) for remote tasking, data exfiltration, and proxy management.

This summary was automatically generated by AI based on the original article and may not be fully accurate.