Mirax Android RAT: Meta Ads Push SOCKS5 Proxy Malware

A new Android remote access trojan, dubbed Mirax, is actively making the rounds, primarily targeting Spanish-speaking regions. According to The Hacker News, this campaign has leveraged Meta’s advertising platforms—Facebook, Instagram, Messenger, and Threads—to reach a staggering 220,000 accounts.

Mirax isn’t just a basic info-stealer; The Hacker News reports it comes packed with advanced RAT capabilities. This allows threat actors to gain full, interactive control over compromised devices. The real kicker? It turns these compromised Android devices into SOCKS5 proxies, effectively weaponizing user devices to anonymize malicious traffic. This tactic makes attribution a nightmare and expands the attackers’ operational infrastructure significantly.