A Fake Streaming App Turned Android Phones Into Remote-Controlled Devices
Zimperium says StreamRat, spread by fake Spanish TV-app ads, can remotely control Android phones and steal logins.
Zimperium reported StreamRat, an Android remote-access trojan delivered through social ads for a fake streaming service that targeted Spanish-speaking users in Spain. One Meta campaign reached about 570,000 users between June 11 and July 3, 2026, though researchers published no confirmed infection count. A dropper pushes sideloading and Accessibility access, then installs a payload that can capture input, watch the screen, overlay fake logins, and let an operator control the phone. Samples used names such as StreamTV Pro, and researchers also found operator tooling.
- StreamRat spreads through fake free-TV ads aimed at Spanish speakers.
- One Meta campaign reached about 570,000 users; infections are unconfirmed.
- After Accessibility access it can view screens, capture input, and tap remotely.
- A dropper sets itself as the home screen and can request VPN access.
- Zimperium found a multi-user control panel with malware-building tools.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 193.32.2.245 | 7.28[.]59 Command-and-control infrastructure. C2 IP address 193.32.2[.]245 Command-and-control infrastructure. File name r1edmi.html |
| ipv4 | 45.147.28.59 | tema de vídeo Name used by the second sample. C2 IP address 45.147.28[.]59 Command-and-control infrastructure. C2 IP address 193.32. |
| sha256 | ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3 | StrεαmTV Pro Name used by the streaming-app sample. SHA-256 ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3 StreamRat-related Android app sample. Package name io.meat. |
| sha256 | e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c | s of compromise (IoCs):- Type Indicator Description SHA-256 e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c StreamRat-related Android app sample. Package name io.base. |
From the original article
4 min read at cybersecuritynews.com
A free television offer led Android users to a dangerous download. Ads for a streaming service urged them to install an app that could give criminals control of their phones, rather than access to shows. The malware behind the campaign is called StreamRat.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.