Cybersecurity researchers at ThreatFabric have disclosed a new Android banking trojan called StreamRat that was pushed to Spanish-speaking users through a fake television-streaming campaign on Meta and can hand its operators near-complete control of an infected device.
According to ThreatFabric, the campaign’s advertising focused on Spain and reached an estimated 570,950 Meta accounts in the European Union that saw it at least once, though the firm did not report totals for infected devices or confirmed victims. StreamRat was also promoted through TikTok, though the report’s TikTok-specific public evidence was limited to landing-page code capable of identifying TikTok as the referring application, with no TikTok ad record or reach figure supplied. ThreatFabric said the same banners were likely displayed on Facebook and Instagram as well, though the primary Meta placement itself remained undetermined.
The Meta campaign ran from June 11, 2026, to July 3, 2026, was identified in late July 2026, and ThreatFabric published its findings on September 2, 2026.
The campaign begins when a social-media lure directs an Android user to a specially crafted website that checks the visitor’s operating system and shows its download button only to Android devices. From there, the visitor can download a file named app.apk. Once the victim launches it, the dropper asks to become the device’s default Home application, so pressing the Home button returns the victim to its interface.
Before fetching the final payload, the dropper requests permission to establish a VPN connection. Once approved, the VPN routes device traffic into a nonfunctional interface while excluding the dropper itself, meaning other apps lose internet connectivity during installation. The dropper’s main page then downloads the StreamRat payload to the public Downloads directory as update_{timestamp}.apk and asks for permission to install applications from unknown sources. After approval, it installs the payload through Android’s package installation mechanism, StreamRat launches, and the payload requests Accessibility access. Once the user grants that permission, the malware connects to its command-and-control (C2) server, and the dropper shuts down the VPN so StreamRat can communicate with it.
ThreatFabric assessed that the connectivity interruption may reduce online reputation and code-analysis checks during installation, though Google Play Protect retains offline detection for known potentially harmful applications, which limits the technique’s effect on the service. Users should stop the installation if a supposed streaming app requests system controls unrelated to streaming.
Once Accessibility access is enabled, StreamRat’s operators can capture keystrokes, display credential-stealing overlays, inspect the visible interface, and control the device remotely. For a visible screen capture, the malware invokes Android’s MediaProjection application programming interface (API), which displays a consent dialog and is typically identified by a screen-sharing indicator; StreamRat can use Accessibility to interact with that consent dialog once the victim has granted the permission. A second capture mode uses the Accessibility takeScreenshot() method, letting the malware capture the screen without triggering the MediaProjection indicator.
Applicability is tied to StreamRat’s installation behavior and requested permissions, since ThreatFabric did not publish an affected Android version range.
ThreatFabric did not attribute the campaign to a named threat actor, but wrote in its StreamRat analysis: “There is little doubt that StreamRat is a new and technically sophisticated threat, developed by individuals with prior experience in the Android malware ecosystem.” The StreamRat payload came from a GitHub account that ThreatFabric linked to an earlier Mirax campaign, and the dropper closely resembled the one used in that operation. Cleafy, in its own Mirax report, said: “The droppers are hosted using GitHub releases, with different backup links and daily package updates.”
ThreatFabric shared the following indicators of compromise:
Google Pixel Watch 5 (45mm)
Robert Haba is the founder and editor-in-chief of Droid Tools. A lifelong gadget enthusiast with over a decade following the Android ecosystem, he built this publication to cut through the noise and give readers honest, real-world coverage of the tech they actually use.
WhatsApp message scheduling has appeared in an Android beta build, allowing users to queue encrypted messages and media up to two weeks in advance.
Global smartphone shipments dropped 20% in Q3 2026 to a 14-year low as memory costs rose, though Samsung retained its top spot with foldables.
Google is emailing a 30% Pixel 11 discount code to select Google AI Pro members, cutting up to $570 off the Pixel 11 Pro Fold without a trade-in.
Google is upgrading Android scam detection across Messages and calls, using Gemini models and new on-device checks to flag suspicious links and phone scams.
The next story loads as you reach the end. You can also load it using the button.
Comments & Discussions
Join the conversation! We use Disqus to handle comments. Click the button below to load the comment section.