Meta ads for a fake Spanish streaming app reached 570,950 EU accounts in 23 days
ThreatFabric traced the StreamRat dropper through four ordinary Android permission prompts to an Accessibility grant that hands operators keystrokes, credential overlays and remote control, with no infection count published.
The Watch · Security desk
What happened
- ThreatFabric detailed StreamRat, an Android banking trojan advertised to Spanish-speaking users as a television-streaming app on Meta, which can give operators near-complete control of an infected device.
- The advertisement focused on Spain and reached an estimated 570,950 Meta accounts in the European Union that saw it at least once, according to ThreatFabric.
- The Meta campaign ran from June 11 to July 3, 2026, was identified in late July 2026, and the analysis was published on September 2, 2026.
- The lure sends Android users to a site that checks the visitor's operating system and shows a download button only to Android devices, serving a file named app.apk.
- No totals for infected devices or confirmed victims have been reported.
Why it matters
- What's now possible capability The takeScreenshot() path removes the one signal a careful user could act on, so the screen-sharing indicator can no longer be treated as evidence that nobody is watching the device.
- What it limits constraint ThreatFabric's own read caps the value of the connectivity blackout: Play Protect's offline checks still fire on known bad packages, so the trick only helps a build that is not yet catalogued.
- What doesn't add up contradiction TikTok is named as a second channel, but the public evidence is landing-page referrer code with no ad record and no reach figure, which leaves Meta as the only distribution path anyone can size.
- Who has to decide decision Daily package updates and rotating backup links mean blocking the two published package names buys days, pushing the durable control onto unknown-sources install policy and Accessibility grants.
Next story · Security · 2d ago
Patched copies of eight Indonesian banking apps let Hirudo fake the apps' own security checksConfirmed5 publishers
Before fetching the final payload, the dropper asks permission to establish a VPN connection, and once approved it routes device traffic into a nonfunctional interface while excluding itself from that route [15]. Other applications lose connectivity during the install, and the dropper shuts the VPN down after the payload executes so StreamRat can reach its command-and-control server [16]. ThreatFabric assessed that the interruption may reduce online reputation and code-analysis checks, while noting that Google Play Protect retains offline detection for known potentially harmful applications, which limits the technique's effect [17].
Four dialogs stand between the launch of app.apk and that C2 connection: default Home application, VPN, install from unknown sources, and Accessibility [23]. The Home grant returns the victim to the dropper's interface whenever the Home button is pressed [6]. The payload lands in the public Downloads directory as update_{timestamp}.apk and is installed through Android's package installation mechanism [7]. On the delivery side, June 11 to July 3, 2026 is 23 days inclusive [24], so the 570,950 figure works out to roughly 24,800 EU accounts a day [25], and what that figure counts is accounts that saw the creative at least once [2].
Once Accessibility is enabled, operators can capture keystrokes, display credential-stealing overlays, inspect the visible interface, and control the device remotely [9]. Screen capture works two ways. MediaProjection shows a consent dialog and is typically identified by a screen-sharing indicator, and the malware can use Accessibility to interact with that dialog after the grant [10]. The alternative calls the Accessibility takeScreenshot() method, which captures the screen outside the MediaProjection indicator entirely [11].
The StreamRat payload came from a GitHub account that ThreatFabric linked to an earlier Mirax campaign, and the dropper closely resembled the one used in that operation [18]. ThreatFabric named no threat actor [19] and said only that the work came from individuals with prior experience in the Android malware ecosystem [12]. Cleafy described the hosting setup: GitHub releases, different backup links, daily package updates [22]. Two package names and two C2 IPs are published [21]; by that hosting description, the package names have a short shelf life.
No Android version range was published, and applicability is tied to the installation behavior and the requested permissions [20]. The response window is also already closed: the findings were published on September 2, 61 days after the ad stopped serving and 83 days after it started [26][27].
What to watch
- Whether ThreatFabric or Meta publishes an install or victim count for the June 11 to July 3 flight.
- Whether the GitHub account tied to the earlier Mirax campaign resurfaces with new dropper releases under fresh backup links.
- Whether any TikTok ad record or reach figure emerges to support the second-channel claim beyond referrer code.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
ThreatFabric disclosed a new Android banking trojan called StreamRat that was promoted to Spanish-speaking users through a fake television-streaming campaign on Meta and can give operators near-complete control of infected devices.
- [2]
ThreatFabric said the campaign's advertisement focused on Spain and reached an estimated 570,950 Meta accounts in the European Union that saw it at least once.
- [3]
Totals for infected devices and confirmed victims remain unreported.
- [4]
The Meta campaign began on June 11, 2026 and ended on July 3, 2026; it was identified in late July 2026; the findings were published on September 2, 2026.
- [5]
The social-media lure directs an Android user to a specially crafted website that checks the visitor's operating system and displays its download button to Android devices, where the visitor can download a file named app.apk.
- [6]
After the victim launches the APK, the dropper asks to become the device's default Home application, which returns the victim to its interface whenever the Home button is pressed.
- [7]
The dropper downloads the StreamRat payload to the public Downloads directory as update_{timestamp}.apk, then asks for permission to install applications from unknown sources and installs the payload through Android's package installation mechanism.
- [8]
The payload requests Accessibility access, and after the user grants that permission the malware connects to its command-and-control server.
- [9]
Once Accessibility access is enabled, operators can capture keystrokes, display credential-stealing overlays, inspect the visible interface, and control the device remotely.
- [10]
For a visible screen capture StreamRat invokes Android's MediaProjection API, which displays a consent dialog and is typically identified by a screen-sharing indicator; the malware can use Accessibility to interact with the consent dialog after that permission is granted.
- [11]
A second mode uses the Accessibility takeScreenshot() method to capture the screen outside the MediaProjection indicator.
- [12]
ThreatFabric said: "There is little doubt that StreamRat is a new and technically sophisticated threat, developed by individuals with prior experience in the Android malware ecosystem."
- [13]
ThreatFabric said StreamRat was also promoted through TikTok, but the report's TikTok-specific public evidence consisted of landing-page code that can identify TikTok as the referring application, with no TikTok ad record or reach figure supplied.
- [14]
The same banners were likely displayed on Facebook and Instagram, while the primary Meta placement remained undetermined.
- [15]
Before fetching the final payload, the dropper requests permission to establish a VPN connection, and once approved the VPN routes device traffic into a nonfunctional interface while excluding the dropper itself.
- [16]
The VPN interface forwards no routed traffic, causing other applications to lose internet connectivity during installation; the dropper shuts the VPN down after the payload executes, allowing StreamRat to communicate with its C2 server.
- [17]
ThreatFabric assessed that the connectivity interruption may reduce online reputation and code-analysis checks, and said Google Play Protect retains offline detection for known potentially harmful applications, limiting the technique's effect on the service.
- [18]
The StreamRat payload came from a GitHub account that ThreatFabric linked to an earlier Mirax campaign, and the dropper closely resembled the one used in that operation.
- [19]
ThreatFabric did not attribute the campaign to a named threat actor.
- [20]
No Android version range was published; applicability is tied to the installation behavior and the requested permissions.
- [21]
Published indicators include packages io.base.one887 (app label spelled with non-Latin lookalike characters as StreamTV Pro) and io.meat.hint (Sistema de video), plus C2 IPs 45.147.28[.]59 and 193.32.2[.]245.
- [22]
Cleafy said the droppers are hosted using GitHub releases, with different backup links and daily package updates.
- [23]
Four permission grants separate launching app.apk from the C2 connection: default Home application, VPN, install from unknown sources, and Accessibility.
- [24]
The Meta ad flight ran 23 days inclusive.
- [25]
The reported reach averages roughly 24,800 EU Meta accounts per day of the flight.
- [26]
Publication came 61 days after the ad stopped serving.
- [27]
Publication came 83 days after the ad started serving.
Sources
2 independent publishers whose own reporting we read for this story.
- malwarebytes.comStreamRat Android malware spreads through Meta and TikTok ads
1 article · September 3, 2026
- thehackernews.comMeta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control
1 article · September 2, 2026
Topics and entities
Topics
- Android Banking Trojans
- Android Accessibility Service Abuse
- Malvertising