Cybersecurity researchers at **ThreatFabric** have unveiled details of **StreamRat**, a potent Android banking trojan. The malware's distribution campaign prominently featured deceptive advertisements for television streaming services on **Meta** platforms, primarily targeting users in Spain. ### Malvertising Campaign Reaches Hundreds of Thousands The malvertising campaign, which ran from June 11 to July 3, 2026, is estimated to have reached approximately 570,950 **Meta** accounts within the European Union. While the exact number of infected devices or confirmed victims remains undisclosed, the broad reach underscores the campaign's potential impact. ### The Sophisticated Attack Chain **StreamRat** employs a multi-stage infection process that relies heavily on social engineering and a succession of user permissions. The attack typically begins with a social media lure directing an **Android** user to a specially crafted website. This site checks the visitor's operating system, presenting a download button only to **Android** devices. Users are prompted to download an `app.apk` file. Upon launching the **Android Package (APK)**, the dropper requests to become the device's default Home application, ensuring persistence and a return to its interface whenever the Home button is pressed. Before delivering the final payload, the dropper requests permission to establish a **VPN** connection. Once approved, this **VPN** routes device traffic into a nonfunctional interface, isolating the dropper itself. This interruption in internet connectivity for other applications during installation is believed to be a tactic to evade online reputation and code-analysis checks, though **Google Play Protect** retains offline detection capabilities.  ### Full Device Takeover Capabilities The dropper subsequently downloads the **StreamRat** payload as `update_{timestamp}.apk` to the public Downloads directory. It then requests permission to install applications from unknown sources. After approval, the payload is installed through **Android**'s package installation mechanism. Upon launch, **StreamRat** requests **Accessibility** access. Once granted, the malware connects to its command-and-control (**C2**) server, enabling attackers to: * Capture keystrokes * Display credential-stealing overlays * Inspect the visible interface * Control the device remotely **ThreatFabric** highlights the sophistication of **StreamRat**, noting that its developers likely possess prior experience in the **Android** malware ecosystem. ### Evasion and Screen Capture Techniques Interestingly, the **VPN** interface established by the dropper forwards no routed traffic, causing other applications to lose internet connectivity during the installation phase. This **VPN** is then shut down after the payload executes, allowing **StreamRat** to communicate with its **C2** server. For screen capture, **StreamRat** can invoke **Android**'s **MediaProjection API**, which typically displays a consent dialog and a screen-sharing indicator. However, with **Accessibility** access, the malware can interact with this consent dialog. A second, more stealthy mode utilizes the **Accessibility** `takeScreenshot()` method to capture the screen without the **MediaProjection** indicator.  ### Links to Previous Campaigns **ThreatFabric** also noted that **StreamRat** was promoted through **TikTok** and that the payload was sourced from a **GitHub** account previously linked to an earlier **Mirax** campaign. The dropper used in the **StreamRat** operation bore a close resemblance to the one employed in **Mirax**. ### Indicators of Compromise (IoCs) Organizations and users should be vigilant for the following **IoCs**: * **SHA-256** (Dropper): `e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c` * **Package** (Dropper): `io.base.one887` * **Application** (Dropper): `StrεαmTV Pro` * **SHA-256** (Payload): `ba83cc3c9535690191018edf73ca5c6001609df991946279aa2e551f142e4d3` * **Package** (Payload): `io.meat.hint` * **Application** (Payload): `Sistema de vídeo` * **C2 IP**: `45.147.28[.]59` * **C2 IP**: `193.32.2[.]245` ### User Recommendations Users are strongly advised to exercise extreme caution when downloading applications from unofficial sources, particularly those promoted through social media advertisements. Always verify the legitimacy of an app and its requested permissions. Any streaming application requesting system controls unrelated to its core function should be immediately suspect, and installation should be halted.