Fake TV Streaming Ads Deliver StreamRat Malware for Remote Android Device Hijacking
StreamRat, a new Android banking trojan, spreads through fake TV-streaming ads on Meta and TikTok.
ThreatFabric identified StreamRat, an Android banking trojan spread by Meta and TikTok ads impersonating a free TV-streaming service in a campaign tracked as Steamtv Esp. The ads exposed an estimated 570,000 Meta users between June 11 and July 3, 2026, overwhelmingly in Spain. A phishing site delivers a dropper that seeks unknown-source installation and Accessibility access, then installs StreamRat, which uses WebSocket command-and-control for overlays, keylogging, and visible or hidden screen capture. Researchers link the delivery infrastructure to earlier GodFather and Mirax activity and say the control panel looks like malware-as-a-service.
- Steamtv Esp. ads mainly targeted Spanish-speaking Android users.
- About 570,000 Meta users were exposed from June 11 to July 3, 2026.
- The dropper reuses infrastructure previously tied to Mirax and GodFather.
- Capabilities include overlays, keylogging, hidden screen capture, and WebSocket C2.
- A role-based panel suggests malware-as-a-service distribution.
- ATT&CK
- T1566 PhishingT1204.002 Malicious FileT1056.001 KeyloggingT1113 Screen CaptureT1071.001 Web Protocols
- Vendors
- Organizations
- ThreatFabricMeta
- Countries
- Spain
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 193.32.2.245 | a2e551f142e4d3 io.meat.hint Sistema de vídeo 45.147.28[.]59 193.32.2[.]245 Note: IP addresses and domains are intentionally defanged |
| ipv4 | 45.147.28.59 | 09df9919462796aa2e551f142e4d3 io.meat.hint Sistema de vídeo 45.147.28[.]59 193.32.2[.]245 Note: IP addresses and domains are intenti |
| sha256 | ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3 | 97718e01689d77338f1cc4a230fcb6c io.base.one887 StrεαmTV Pro ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3 io.meat.hint Sistema de vídeo 45.147.28[.]59 193.32.2[.]245 |
| sha256 | e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c | tors of Compromise SHA-256 Package name Application name C2 e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c io.base.one887 StrεαmTV Pro ba83cc3c9535690191018edf73ca5c6 |
From the original article
3 min read at gbhackers.com
StreamRat, a newly identified Android banking trojan distributed through deceptive Meta and TikTok advertisements impersonating a free television-streaming service. The campaign, tracked as “Steamtv Esp. ,” primarily targeted Spanish-speaking Android users and exposed an estimated 570,000 Meta users between June 11 and July 3, 2026, with Spain accounting for the overwhelming majority of observed targets.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.