Six Android Malware Families Target Pix Payments, Banking Apps, and Crypto Wallets

Six Android malware families discovered: PixRevolution (targets Brazil's Pix payment platform with real-time payment hijacking using human/AI agent operators), TaxiSpy RAT (targets Russian banking apps with VNC-like remote control via WebSocket), BeatBanker (uses inaudible audio loop persistence mechanism, includes cryptocurrency miner and banking trojan), Mirax (MaaS offering with banking overlays and SOCKS5 proxy), Oblivion RAT (automated permission-granting mechanism bypassing security on major manufacturers), and SURXRAT (incorporates LLM module and ransomware-style screen locker). Malware spreads via fake Google Play Store pages, abuses accessibility services and MediaProjection API, connects to external servers on TCP port 9000, uses Firebase Cloud Messaging for C2, monitors web browsers, and employs various evasion techniques including native library encryption and rolling XOR string obfuscation.