Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control
ThreatFabric details StreamRat, a new Android banking trojan spread via Meta malvertising in Spain that reached about 571,000 EU accounts.
ThreatFabric reported that a fake TV-streaming malvertising campaign on Meta promoted StreamRat, a technically sophisticated Android banking trojan, targeting Spanish-speaking users; the ads reached an estimated 570,950 Meta accounts in the EU between June 11 and July 3, 2026. Once installed via sideloaded APKs, the trojan abuses Accessibility to log keystrokes, show credential-stealing overlays, capture screens, and remotely control devices, and was also promoted through TikTok. Its dropper requests default Home app and VPN permissions and was hosted via GitHub releases, closely resembling one used in the earlier Mirax campaign. C2 infrastructure includes IPs 45.147.28.59 and 193.32.2.245, and no named threat actor was attributed.
- Meta ad campaign reached an estimated 570,950 EU accounts; confirmed infections unreported.
- StreamRat abuses Accessibility for keystrokes, overlays, screen capture, and remote device control.
- Dropper requests Home app and VPN permissions; routes traffic to a dead interface during install.
- Payload traced to a GitHub account linked to the earlier Mirax campaign.
- Also promoted via TikTok; IoCs include C2 IPs 45.147.28.59 and 193.32.2.245.
- Vendors
- MetaThreatFabricCleafy
- Malware
- StreamRat
- Organizations
- ThreatFabricMetaTikTok
- Countries
- Spain
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 193.32.2.245 | plication - Sistema de vídeo C2 IP - 45.147.28[.]59 C2 IP - 193.32.2[.]245 The Meta campaign began on June 11, 2026. It ended on Jul |
| ipv4 | 45.147.28.59 | ckage - io.meat.hint Application - Sistema de vídeo C2 IP - 45.147.28[.]59 C2 IP - 193.32.2[.]245 The Meta campaign began on June 11 |
| sha256 | ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3 | ckage - io.base.one887 Application - StrεαmTV Pro SHA-256 - ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3 Package - io.meat.hint Application - Sistema de vídeo C2 IP |
| sha256 | e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c | d the following indicators of compromise (IoCs) - SHA-256 - e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c Package - io.base.one887 Application - StrεαmTV Pro SHA-256 |
From the original article
3 min read at thehackernews.com
Cybersecurity researchers have disclosed details of a new Android banking trojan called StreamRat that was promoted to Spanish-speaking users through a fake television-streaming campaign on Meta and can give operators near-complete control of infected devices. ThreatFabric said the campaign's advertisement focused on Spain and reached an estimated 570,950 Meta accounts in the European Union
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.