Threat reportMalwareTL-2026-4310
PanDa Android RAT delivered via ShellA loader and Meta Ads malvertising against Mexican users by Chinese-speaking actors
PanDa Android RAT delivered via ShellA loader and Meta Ads (TL-2026-4310), also tracked as AppPanda, is a high-severity malware campaign, first published 2026-10-23. It has no confirmed attribution, affects Google Android, maps to 9 MITRE ATT&CK techniques (T1204.002, T1406, T1417.001), and is covered by 9 detection rules and 19 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 19Indicators of compromise
Key facts for TL-2026-4310
- Threat ID
- TL-2026-4310
- Also known as
- AppPanda, PanDa RAT campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, banking, consumer, entertainment
- Target regions
- mexico, nigeria, Latin America
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in PanDa Android RAT delivered via ShellA loader and Meta Ads
Malware and tooling: BTMOB, PanDa, ShellA, APK Factory, AppPanda, Appchi (Pixel Center), BAT1688
How PanDa Android RAT delivered via ShellA loader and Meta Ads works
Intel 471 reports Chinese-speaking threat actors targeting Spanish-speaking Android users in Mexico with the PanDa remote access trojan, delivered by the ShellA loader through fake streaming apps promoted in Meta Ads. PanDa provides screen streaming/HVNC, accessibility-services keylogging and screen lock capture; its keylogger targets 62 banks and financial institutions in Mexico and Nigeria.
Beginning in May 2026, Chinese-speaking operators ran paid Meta (Facebook) advertising campaigns offering free Netflix and later other streaming services to Spanish-speaking Android users in Mexico. The ads led to actor-controlled phishing landing pages that served a sideloaded APK. In July 2026 the actors rotated to NovaFlix and a growing set of fictitious streaming brands (AlvoPlay, CeloloPlay, CineviaBox, EvotiPrime, PicomiPlay, UltraTV and others); in August 2026 they integrated the Facebook Pixel SDK for better ad targeting and continued Netflix- and PicomiPlay-themed campaigns in mid-August.
The delivered APK is a loader tracked as ShellA. ShellA changes device settings to allow sideloading, reconstructs and re-signs its embedded payload on the device (randomizing the signature to defeat hash-based detection), and presents a fake 'smooth playback' prompt that disguises the Accessibility Services permission request. It then installs PanDa, an Android RAT with screen streaming, hidden VNC (HVNC) / silent remote control, keylogging via accessibility services, screen-lock capture and device-settings modification. Secondary reporting also lists abuse of Device Admin, SMS access, notification access and display-over-other-apps permissions. PanDa communicates with its C2 over unencrypted WebSocket connections. Intercepted C2 traffic showed keylogging targeting of 62 banks and financial institutions across Mexico and Nigeria.
Intel 471 gained visibility into an exposed, unauthenticated management panel named AppPanda (with Chinese-language interface, the basis for the 'Chinese-speaking' attribution). Between July 2-7, 2026 it logged more than 350,000 landing page visits, about 200,000 unique visitors and nearly 15,000 malicious APK downloads across 22 phishing domains. Supporting tooling includes APK Factory (a payload builder supporting both PanDa and the BTMOB RAT), BAT1688 (an automated obfuscation/re-signing platform that regenerates APKs every 60 minutes to evade antivirus) and Appchi / Pixel Center (a Facebook ad campaign management tool paid for with HuiTongCard virtual payment cards). Full IOCs (URLs, IPs, hashes) are in Intel 471's downloadable AppPanda report and were not available publicly; only 12 of the 22 phishing domains were found in public secondary reporting. A BeaconBeagle lookup for alvoplay.com returned no C2 configuration matches.
MITRE ATT&CK techniques used in TL-2026-4310
Execution
T1204.002 User Execution: Malicious File
defense-evasion
T1406 Obfuscated Files or Information; T1655.001 Masquerading: Match Legitimate Name or Location
collection
T1417.001 Input Capture: Keylogging
command-and-control
T1437.001 Application Layer Protocol: Web Protocols
Collection
Resource Development
T1583.001 Acquire Infrastructure: Domains
privilege-escalation
T1626.001 Abuse Elevation Control Mechanism: Device Administrator Permissions
initial-access
Affected products and versions in PanDa Android RAT delivered via ShellA loader and Meta Ads
- Google — Android
Vulnerable versions: Android devices permitting sideloading and Accessibility Services grants
Remediation for PanDa Android RAT delivered via ShellA loader and Meta Ads
Immediate actions
- Block the listed phishing domains at DNS, proxy and mobile-security layers
- Hunt mobile and proxy logs for outbound traffic to the listed domains and for unencrypted WebSocket traffic from mobile endpoints
- Alert customers and employees in Mexico about fake streaming apps advertised on Meta platforms
Workarounds
- Install apps only from Google Play or official provider sites
- Disable 'Install unknown apps' for browsers and social apps
- Keep Google Play Protect enabled
- Reject Accessibility Services requests from streaming apps
Longer-term hardening
- Enforce MDM policy restricting installation from unknown sources
- Run user awareness training on malvertising and sideloading
- Use behavioral mobile threat defense because APK hashes rotate roughly every 60 minutes
Timeline of PanDa Android RAT delivered via ShellA loader and Meta Ads
- Netflix-themed Meta Ads phishing campaigns delivering the ShellA loader begin (May 2026; exact day not stated).
- Actors shift to NovaFlix and fictitious streaming brands such as AlvoPlay and CeloloPlay (July 2026; exact day not stated).
- Start of the July 2-7 window in which the exposed AppPanda panel logged 350,000+ landing page visits, ~200,000 unique visitors and ~15,000 APK downloads across 22 phishing domains.
- End of the observed AppPanda panel telemetry window.
- Actors integrate the Facebook Pixel SDK to improve ad targeting (August 2026; exact day not stated).
- Netflix- and PicomiPlay-themed campaign continues in mid-August 2026.
- Intel 471 publishes its analysis of the PanDa RAT, ShellA loader and AppPanda operation.
Sources cited for PanDa Android RAT delivered via ShellA loader and Meta Ads
- Chinese-speaking threat actors targeting Mexican Android users with remote access Trojan
- Inside AppPanda: a sprawling phishing operation targeting Android users in Mexico (Intel 471 whitepaper)
- Fake Netflix APK Delivers PanDa RAT Through Meta Ads (GridinSoft)
- Facebook Ads Promote Fake Streaming Apps Delivering PanDa RAT (Hackread)
- PanDa RAT brief (CraftedSignal)
- BTMOB RAT Gives Criminals a Point-and-Click Kit to Take Over Your Android Phone (Security Affairs)
- Meta Ads push StreamRat Android trojan (The Hacker News) - related but separate Spain-targeting campaign
Detection coverage for TL-2026-4310
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4310 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.