StreamRat Android Trojan Distributed via Meta Ads, Offers Near-Complete Device Control

A sophisticated new Android banking trojan, dubbed StreamRat, has been identified by cybersecurity researchers, masquerading as a legitimate TV streaming application. The malware was distributed through malvertising campaigns on Meta platforms, specifically targeting Spanish-speaking users, primarily within the European Union. ThreatFabric, the research firm that disclosed the findings, estimated that the campaign reached over 570,000 Meta accounts, highlighting the broad reach of this social engineering tactic.

The campaign's effectiveness relies on luring unsuspecting users with fake streaming service advertisements. Once a user clicks on the ad, they are directed to a website where they can download a malicious Android Package (APK) file. This initial dropper application is designed to trick users into granting it significant permissions, including becoming the device's default Home application. This allows the dropper to intercept the user's interaction with the device, returning them to its interface whenever the Home button is pressed.

Before fetching the final StreamRat payload, the dropper employs a clever technique involving a VPN connection. It requests permission to establish a VPN, which, once granted, routes the device's traffic through a non-functional interface. This interruption is designed to hinder online reputation and code-analysis checks by temporarily cutting off internet access for other applications. After the payload is downloaded and installed, the VPN is shut down, allowing the StreamRat malware to establish communication with its command-and-control (C2) server.

The StreamRat payload, downloaded as an update file, then requests Accessibility access. This is a critical permission that, once granted, enables the malware to perform a wide range of malicious actions. Attackers can capture keystrokes, display convincing credential-stealing overlays, inspect the visible interface of applications, and even remotely control the device. The malware also utilizes Android's MediaProjection API to capture screen content, often bypassing the standard screen-sharing indicator by using Accessibility services to interact with the consent dialog.

Researchers noted that the dropper's design closely resembles that used in a previous Mirax campaign, suggesting a potential link between threat actors or shared development resources. The campaign ran from June 11 to July 3, 2026, with findings published on September 2, 2026. While the primary Meta placement remains undetermined, evidence suggests similar banners were displayed on Facebook and Instagram, and potentially on TikTok.

The StreamRat trojan's capabilities pose a significant threat to user data and financial information. By gaining near-complete control over infected devices, attackers can steal sensitive credentials, conduct fraudulent transactions, and compromise personal privacy. The reliance on social engineering and malvertising makes it a potent threat that bypasses traditional app store security measures.

While Google Play Protect offers some offline detection for known malicious applications, the techniques employed by StreamRat, such as the VPN interruption and the use of Accessibility services, present challenges for real-time detection. Users are advised to be cautious of app installation requests, especially those that ask for system-level permissions unrelated to the app's stated function, and to avoid sideloading applications from untrusted sources.

Indicators of compromise (IoCs) provided by ThreatFabric include specific SHA-256 hashes for the malicious APKs, package names (e.g., io.base.one887 for StrεαmTV Pro and io.meat.hint for Sistema de vídeo), and C2 server IP addresses (45.147.28[.]59 and 193.32.2[.]245).