Vendor

ThreatFabric

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 20, 2026 · last 13d ago

Timeline2 articles

Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control

ThreatFabric details StreamRat, a new Android banking trojan spread via Meta malvertising in Spain that reached about 571,000 EU accounts.

ThreatFabric reported that a fake TV-streaming malvertising campaign on Meta promoted StreamRat, a technically sophisticated Android banking trojan, targeting Spanish-speaking users; the ads reached an estimated 570,950 Meta accounts in the EU between June 11 and July 3, 2026. Once installed via sideloaded APKs, the trojan abuses Accessibility to log keystrokes, show credential-stealing overlays, capture screens, and remotely control devices, and was also promoted through TikTok. Its dropper requests default Home app and VPN permissions and was hosted via GitHub releases, closely resembling one used in the earlier Mirax campaign. C2 infrastructure includes IPs 45.147.28.59 and 193.32.2.245, and no named threat actor was attributed.

The Hacker NewsSep 2, 12:22 UTC · 13d agoMalware in the wild

Manic: The Android Malware That Exfiltrates Data Even When the Phone Is Offline

ThreatFabric identifies Manic, an Android banking fraud and spyware platform targeting Ukraine with offline Bluetooth/Wi-Fi Direct mesh exfiltration and device takeover.

ThreatFabric's Mobile Threat Intelligence team identified Manic, an Android malware active in the wild since at least February 2026 that combines banking fraud with surveillance and device-control capabilities. It monitors 169 Android apps including Ukrainian banks, government and eID services, messaging apps, crypto exchanges, and 2FA tools, using the Accessibility service as a classified UI keylogger and WebRTC for live screen viewing and remote control. A distinctive store-and-forward relay exfiltrates AES-GCM-encrypted data through nearby infected devices over Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT, supporting chains of up to four hops when direct C2 is unavailable. A July update added stronger anti-analysis, in-memory DEX loading, lock-secret phishing to extract device PINs, and hiding from the app launcher.

Security AffairsAug 20, 18:03 UTC · 26d agoMalware in the wild

Appears with

organization ThreatFabric 2 malware StreamRat 1 organization Meta 1 organization Security Affairs 1 organization TikTok 1 product Manic 1 product Mirax 1 product StreamRat 1 vendor Cleafy 1 vendor Meta 1 victim Ukrainian banks 1 malware Manic 1 victim Ukrainian government and identity services 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.