# StreamRat Android Banking Trojan Spreads via Fake Streaming-Service Ads on Meta and TikTok

> StreamRat, a newly discovered Android banking Trojan and infostealer built on a Malware-as-a-Service (MaaS) backend, is being distributed through fake free-TV-streaming-service ads on Meta (Facebook/Instagram) and TikTok, primarily targeting Spanish-speaking users in Spain. A Meta campaign named "Steamtv Esp." ran June 11 to July 3, 2026 and reached roughly 570,000-570,950 users; once sideloaded, StreamRat abuses Accessibility Services, MediaProjection, and Device Administrator privileges to deliver credential-stealing overlays, keylogging, HVNC/VNC-style screen streaming, and full remote device control.

- **Published:** 2026-09-03T00:00:00Z
- **Last reviewed:** 2026-09-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2312
- **ID:** TL-2026-2312
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ThreatFabric researchers uncovered StreamRat, an Android banking Trojan/infostealer distributed through malvertising on Meta and TikTok impersonating a free TV-streaming service. The Meta campaign, internally named "Steamtv Esp.," ran from June 11 to July 3, 2026 and reached an estimated 570,000-570,950 accounts in the EU, overwhelmingly Spanish-speaking users in Spain; identical banner creative was also run on TikTok.

Victims who click the ad are sent to a lure site that fingerprints the visitor's OS (blocking non-Android devices) and referral source (Instagram, TikTok, Facebook, or generic browser), then serves referrer-tailored install instructions via a page named r1edmi.html. The victim is guided to enable installation from unknown sources and download an initial APK (app.apk). The APK is a dropper built from a set of interconnected HTML/JavaScript pages (Index.html, Set_launcher.html, Vpn_required.html) rather than compiled native obfuscation. The dropper coerces the victim into three escalating grants: (1) setting the dropper as the default/HOME launcher, so pressing the Home button re-displays the dropper's social-engineering flow; (2) establishing a Device VPN permission used to create a deliberately non-functional VPN that blocks Internet access for every other app on the device (excluding the dropper itself), degrading other security tools' ability to perform cloud/online-reputation checks during installation; and (3) downloading and installing a second-stage payload (named update_{timestamp}.apk) that requests Accessibility Services. Once Accessibility access is granted, the dropper uninstalls/removes itself, and the final payload becomes the persistent backdoor.

Two payload samples were identified: package io.base.one887 (app label "StrεαmTV Pro") and package io.meat.hint (app label "Sistema de vídeo"). Malwarebytes detects the family generically as Android/PUP.Agent.ACR02DB0614H7.

Once active, the bot communicates with hardcoded C2 servers (45.147.28.59 and 193.32.2.245) over a WebSocket-based, binary RPC-like protocol: the initial upgrade request carries custom X-Device-Id / X-Device-Model / X-Api-Level headers, and subsequent frames use a 2-byte opcode + 4-byte command ID + payload format (bot responses mirror with a 4-byte command ID + 1-byte status + 4-byte length + payload). The bot supports 37+ commands spanning shell execution, device lock/wake, VNC-mode and HVNC-mode screen capture, an Accessibility Node Viewer for remote UI inspection/control, overlay management, arbitrary app launching, PIN/pattern extraction and remote device unlock, Accessibility-based keylogging, and fake notification generation.

Credential theft is delivered through a foreground-app-monitoring loop: the bot sends maintenance_check and injection_check requests containing the current foreground package name, and the C2 responds with an HTML overlay (saved client-side as <package_name>.html) rendered in a WebView with a JavaScript bridge enabled. Overlay types include a black screen covering ~98% of the display to mask fraudulent activity from the victim, a fake system-update screen used as a distraction cover, and interactive injection overlays used to harvest typed data. To reduce backend load and limit detectable signal, the malware computes Adler-32 checksums over serialized AccessibilityNodeInfo UI-tree dumps and only reports changed states.

Control-panel code analysis indicates StreamRat was built as a Malware-as-a-Service offering: the backend implements user/supervisor/admin role separation for multiple simultaneous operators and includes a dedicated builder for customers to generate customized droppers and payloads. ThreatFabric ties the same threat actor to at least two prior Android financial-malware families -- GodFather and StreamRat's most direct predecessor, Mirax (an April 2026 campaign). The StreamRat payload was retrieved from a GitHub repository belonging to the same developer account previously used to distribute Mirax, with daily package/release updates, and the StreamRat dropper's design closely mirrors Mirax's dropper architecture, indicating iterative reuse rather than a clean-sheet build. ThreatFabric did not attach a named threat-actor label to the operator.

## MITRE ATT&CK

- T1456 Drive-By Compromise
- T1626 Abuse Elevation Control Mechanism
- T1626.001 Device Administrator Permissions
- T1655 Masquerading
- T1629 Impair Defenses
- T1630 Indicator Removal on Host
- T1407 Download New Code at Runtime
- T1417 Input Capture
- T1417.001 Keylogging
- T1417.002 GUI Input Capture
- T1424 Process Discovery
- T1513 Screen Capture
- T1437 Application Layer Protocol
- T1437.001 Web Protocols
- T1544 Ingress Tool Transfer
- T1516 Input Injection

## Sources

- [StreamRat Android malware spreads through Meta and TikTok ads](https://www.malwarebytes.com/blog/news/2026/09/streamrat-android-malware-spreads-through-meta-and-tiktok-ads)
- [Uncovering StreamRat: From Meta Ads to Full Device Takeover](https://www.threatfabric.com/blogs/from-meta-ads-to-full-device-takeover-uncovering-streamrat)
- [Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control](https://thehackernews.com/2026/09/meta-ads-push-streamrat-android-trojan.html)
- [StreamRAT Abuses Android Accessibility, MediaProjection and HVNC](https://gbhackers.com/streamrat-abuses-android/)
- [New StreamRAT Android Trojan Gives Hackers Full Remote Control Through VNC and Accessibility](https://cybersecuritynews.com/streamrat-android-trojan/)
- [This devious Android malware has returned disguised as TikTok or streaming apps](https://www.techradar.com/pro/security/this-devious-android-malware-has-returned-disguised-as-tiktok-or-streaming-apps-and-is-now-using-blockchain-to-remain-undetected)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2312