# PanDa Android RAT delivered via ShellA loader and Meta Ads malvertising against Mexican users by Chinese-speaking actors

> Intel 471 reports Chinese-speaking threat actors targeting Spanish-speaking Android users in Mexico with the PanDa remote access trojan, delivered by the ShellA loader through fake streaming apps promoted in Meta Ads. PanDa provides screen streaming/HVNC, accessibility-services keylogging and screen lock capture; its keylogger targets 62 banks and financial institutions in Mexico and Nigeria.

- **Published:** 2026-10-23T20:48:57Z
- **Last reviewed:** 2026-10-23T20:48:57Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4310
- **ID:** TL-2026-4310
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Beginning in May 2026, Chinese-speaking operators ran paid Meta (Facebook) advertising campaigns offering free Netflix and later other streaming services to Spanish-speaking Android users in Mexico. The ads led to actor-controlled phishing landing pages that served a sideloaded APK. In July 2026 the actors rotated to NovaFlix and a growing set of fictitious streaming brands (AlvoPlay, CeloloPlay, CineviaBox, EvotiPrime, PicomiPlay, UltraTV and others); in August 2026 they integrated the Facebook Pixel SDK for better ad targeting and continued Netflix- and PicomiPlay-themed campaigns in mid-August.

The delivered APK is a loader tracked as ShellA. ShellA changes device settings to allow sideloading, reconstructs and re-signs its embedded payload on the device (randomizing the signature to defeat hash-based detection), and presents a fake 'smooth playback' prompt that disguises the Accessibility Services permission request. It then installs PanDa, an Android RAT with screen streaming, hidden VNC (HVNC) / silent remote control, keylogging via accessibility services, screen-lock capture and device-settings modification. Secondary reporting also lists abuse of Device Admin, SMS access, notification access and display-over-other-apps permissions. PanDa communicates with its C2 over unencrypted WebSocket connections. Intercepted C2 traffic showed keylogging targeting of 62 banks and financial institutions across Mexico and Nigeria.

Intel 471 gained visibility into an exposed, unauthenticated management panel named AppPanda (with Chinese-language interface, the basis for the 'Chinese-speaking' attribution). Between July 2-7, 2026 it logged more than 350,000 landing page visits, about 200,000 unique visitors and nearly 15,000 malicious APK downloads across 22 phishing domains. Supporting tooling includes APK Factory (a payload builder supporting both PanDa and the BTMOB RAT), BAT1688 (an automated obfuscation/re-signing platform that regenerates APKs every 60 minutes to evade antivirus) and Appchi / Pixel Center (a Facebook ad campaign management tool paid for with HuiTongCard virtual payment cards). Full IOCs (URLs, IPs, hashes) are in Intel 471's downloadable AppPanda report and were not available publicly; only 12 of the 22 phishing domains were found in public secondary reporting. A BeaconBeagle lookup for alvoplay.com returned no C2 configuration matches.

## MITRE ATT&CK

- T1583.001 Acquire Infrastructure: Domains
- T1660 Phishing
- T1204.002 User Execution: Malicious File
- T1626.001 Abuse Elevation Control Mechanism: Device Administrator Permissions
- T1655.001 Masquerading: Match Legitimate Name or Location
- T1406 Obfuscated Files or Information
- T1417.001 Input Capture: Keylogging
- T1513 Screen Capture
- T1437.001 Application Layer Protocol: Web Protocols

## Sources

- [Chinese-speaking threat actors targeting Mexican Android users with remote access Trojan](https://www.intel471.com/blog/chinese-speaking-threat-actors-targeting-mexican-android-users-with-remote-access-trojan)
- [Inside AppPanda: a sprawling phishing operation targeting Android users in Mexico (Intel 471 whitepaper)](https://www.intel471.com/resources/whitepapers/inside-apppanda-a-sprawling-phishing-operation-targeting-android-users-in-mexico)
- [Fake Netflix APK Delivers PanDa RAT Through Meta Ads (GridinSoft)](https://blog.gridinsoft.com/fake-netflix-apk-panda-rat/)
- [Facebook Ads Promote Fake Streaming Apps Delivering PanDa RAT (Hackread)](https://hackread.com/facebook-ads-fake-streaming-apps-panda-rat/)
- [PanDa RAT brief (CraftedSignal)](https://feed.craftedsignal.io/briefs/2026-09-panda-rat/)
- [BTMOB RAT Gives Criminals a Point-and-Click Kit to Take Over Your Android Phone (Security Affairs)](https://securityaffairs.com/192846/malware/btmob-rat-gives-criminals-a-point-and-click-kit-to-take-over-your-android-phone.html)
- [Meta Ads push StreamRat Android trojan (The Hacker News) - related but separate Spain-targeting campaign](https://thehackernews.com/2026/09/meta-ads-push-streamrat-android-trojan.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4310