Mirax Android RAT Turns Phones Into SOCKS5 Proxies via Meta Ads

A new Android remote access Trojan named Mirax blends traditional RAT capabilities with a residential SOCKS5 proxy feature, allowing attackers to route traffic through infected devices. Campaigns reach about 220,000 accounts on Facebook, Instagram, Messenger, and Threads via Meta ads promoting a malware dropper, with Mirax offered as a MaaS to a small, Russia-focused affiliate network. Once installed, it can capture data, render fake overlays for credential theft, and maintain multiple C2 channels (WebSockets on ports 8443, 8444, and 8445) for remote control, streaming, exfiltration, and proxy deployment. Distribution uses GitHub-hosted droppers and two crypters (Virbox and Golden Crypt) with anti-analysis checks, reflecting a trend of combining RAT functionality with proxy networks for monetization and broader reach.