A Fake Streaming App Turned Android Phones Into Remote-Controlled Devices
Zimperium says StreamRat, spread by fake Spanish TV-app ads, can remotely control Android phones and steal logins.
62
Malware
StreamRat
- Mentions · 7d0
- Mentions · 30d0
- All mentions7
- First seenSep 2, 2026
- Last mentionedSep 23, 2026
Timeline
7 articles · newest firstFake TV Streaming Ads Deliver StreamRat Malware for Remote Android Device Hijacking
StreamRat, a new Android banking trojan, spreads through fake TV-streaming ads on Meta and TikTok.
76
New Android Malware Steals Banking PINs and Reinstalls Itself After Users Delete It
Zimperium identified RatHat, an Android banking trojan capturing PINs via overlays and abusing Wireless Debugging to reinstall itself after removal.
55
New Android Ransomware Records Screens, Steals OTPs and Secretly Takes Photos of Victims
Zimperium uncovered Mantax Otax, an Android ransomware that encrypts files, records screens, steals OTPs, and secretly photographs victims.
45
Google Play Early Access Abused to Push Thousands of Deceptive Android Apps
Bitdefender found abuse of Google Play's review-free Early Access program to push thousands of deceptive casino and reward apps promoted with AI deepfake ads.
50
StreamRat Android malware spreads through Meta and TikTok ads
Malwarebytes reports StreamRat Android banking trojan spread via Meta and TikTok ads reaching roughly 570,000 users, mostly in Spain.
55
Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control
ThreatFabric details StreamRat, a new Android banking trojan spread via Meta malvertising in Spain that reached about 571,000 EU accounts.
55
Appears with
- Androidproduct · 3
- Metaorganization · 3
- Metavendor · 2
- Googlevendor · 2
- StreamRatproduct · 2
- Zimperiumorganization · 2
- ThreatFabricorganization · 2
- Mantax Otaxmalware · 2
- Zimperiumvendor · 2
- Hagasecamalware · 1
- Bitdefendervendor · 1
- Facebookproduct · 1
- Miraxmalware · 1
- TikTokproduct · 1
- RatHatproduct · 1
- Malwarebytesvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.