StreamRat, the Android Trojan Spread Through Fake Streaming Ads on Meta

A Campaign Targeting Spanish-Speaking Users

ThreatFabric published its analysis of StreamRat, a new Android banking trojan capable of gaining near-complete control over infected devices, on September 2, 2026. The malware was promoted through a fake television streaming offer aimed primarily at Spanish-speaking users, with a particular focus on Spain.

The advertising campaign on Meta was active from June 11, 2026 to July 3, 2026, and was identified in late July 2026. Based on the available data, the ads may have reached 570,950 Meta accounts in the European Union, with each account exposed at least once.

This figure measures the potential reach of the advertising campaign, not the number of infections. Neither the total number of compromised devices nor the number of confirmed victims has been disclosed.

The banners may have appeared on both Facebook and Instagram, but it has not been determined which service was the primary distribution channel. Evidence linked to TikTok also emerged: the code of the page used to distribute the APK could identify TikTok as the originating application. However, no verifiable ads or data are available to demonstrate the reach of any campaign on the platform.

From a Fake TV Service to the Installation of Two APKs

The infection does not exploit an Android vulnerability. Instead, it requires the victim to manually download an external application and approve a series of particularly invasive requests.

The ad directs the user to a website controlled by the operators. The page identifies the visitor’s operating system and, in the case of Android, displays a button to download a file named app.apk.

This first APK acts as a dropper: a component responsible for preparing the device and installing the main malware. After launching, it asks to become the default Home application. If the user accepts, the dropper’s interface returns to the foreground whenever the Home button is pressed, making it more difficult to interrupt the process.

The program then requests permission to create a VPN connection. Once authorized, the VPN routes the device’s traffic through an interface that does not actually forward the data, while excluding the dropper itself from the block. Other applications temporarily lose Internet access, but the malicious component can continue downloading the payload.

StreamRat is placed in the public Downloads directory under a name following this format:

update_{timestamp}.apk

The dropper then tricks the user into enabling installation from unknown sources and launches Android’s standard mechanism for installing the second package. Once the payload has executed, the VPN is terminated and connectivity is restored. StreamRat can then contact its command-and-control infrastructure.

The disconnection appears to be designed to interfere with online reputation checks and certain validations performed during installation. This technique does not completely neutralize Google Play Protect, which retains offline detection capabilities for known malicious applications.

Accessibility Enables Remote Control

After launching, StreamRat requests access to Android Accessibility services. These features are designed to assist people with disabilities, but they also provide deep visibility into the interface and the ability to interact with displayed elements.

With the permission enabled and a connection to the C2 server established, the operators can record what is typed, read the content displayed on the screen, and issue remote commands. The malware can also overlay fake windows on top of legitimate applications, tricking victims into entering banking credentials or other sensitive information.

StreamRat has two screen-capture capabilities. The first uses the Android MediaProjection API, which normally displays a consent prompt and an indicator while screen sharing is active. After obtaining Accessibility access, however, the trojan can interact with the authorization window, reducing the level of control actually exercised by the user.

The second method uses the Accessibility takeScreenshot() function. This approach allows images to be captured without relying on the indicator normally associated with MediaProjection.

By combining screenshots, keylogging, overlays, and interface control, the operators can monitor the victim’s activity and interact with financial applications. The risk therefore extends beyond passwords: one-time codes, messages, account balances, personal data, and information displayed during a banking session may also be exposed.

No precise range of affected or compatible Android versions has been published. Exposure depends primarily on installing the external APK and granting the requested permissions.

Similarities to the Earlier Mirax Operation

The analyzed payload came from a GitHub account that ThreatFabric links to an earlier campaign known as Mirax. The dropper also shows strong similarities to the software used in that operation.

A Cleafy analysis of Mirax described the use of GitHub releases to host droppers, together with alternative links and daily package updates. StreamRat may therefore represent a continuation of the same operational approach, relying on similar distribution techniques and portions of previously used infrastructure.

However, the available evidence does not support definitive attribution. ThreatFabric considers it likely that developers with experience in Android malware are involved, but it has not attributed StreamRat to a named criminal group.

Packages, Hashes, and Servers to Search For

Administrators and mobile security teams can check for the presence of the two identified samples.

Indicator	Sample 1	Sample 2
Application name	StrεαmTV Pro	Sistema de vídeo
Package	io.base.one887	io.meat.hint
SHA-256	e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c	ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3

The IP addresses associated with the C2 infrastructure are:

45.147.28[.]59
193.32.2[.]245

In addition to static indicators, teams should look for unusual changes to the device configuration: newly selected default Home applications, recently created VPNs, Accessibility access granted to unknown software, and permissions for screen recording.

The Downloads directory deserves particular attention. Files matching the update_{timestamp}.apk pattern, especially when found alongside one of the listed packages, are a significant warning sign. Hashes allow precise identification of known samples, but rebuilt variants may produce different values.

How to Respond to a Suspected Device Infection

A streaming application has no legitimate reason to become the default launcher, create a VPN, install additional APKs, and obtain Accessibility control. This combination of requests should prompt the user to immediately stop the installation.

Google Play Protect should remain enabled. Although it cannot guarantee that every variant will be blocked, it can detect previously cataloged potentially harmful applications offline.

If an infection is suspected, the device should be isolated from the network. Accessibility access should then be revoked, any Home-screen privileges removed, unknown VPNs deleted, and malicious packages uninstalled. Remaining APKs in the Downloads folder should be deleted after the evidence required for analysis has been collected.

Technical remediation is not the end of the problem. All credentials used on the phone during the potential compromise should be considered exposed, particularly banking credentials. They should be changed from a trusted device, active sessions reviewed, and any unrecognized financial transactions or account access investigated.