A new Android banking trojan called StreamRat reached an estimated 570,950 Meta accounts in the European Union through a fake television-streaming campaign targeting Spanish-speaking users, according to a ThreatFabric analysis published September 2, 2026. The malware gives attackers near-complete control of infected devices after victims grant a series of permissions following installation. ThreatFabric described StreamRat as "a new and technically sophisticated threat, developed by individuals with prior experience in the Android malware ecosystem," though the firm did not link the operation to any known threat group.
The Meta campaign ran from June 11 through July 3, 2026, with the advertisements concentrated on Spain. ThreatFabric identified the operation in late July 2026, though totals for infected devices and confirmed victims were not disclosed. The malware was also promoted through TikTok, though public evidence for that platform consisted only of landing-page code capable of identifying TikTok as the referring application, with no ad record or reach figure provided. The same banners likely appeared on Facebook and Instagram, while the primary Meta placement remained undetermined.
Once Accessibility access is enabled, operators can capture keystrokes, display credential-stealing overlays, inspect the visible interface, and control the device remotely, the report states. The attack begins when a social-media lure directs an Android user to a specially crafted website that checks the visitor's operating system and displays its download button only to Android devices. The victim downloads a file named app.apk, which then asks to become the device's default Home application. Before retrieving the final payload, the dropper requests permission to establish a VPN connection that routes device traffic into a nonfunctional interface while excluding the dropper itself. The dropper's main page downloads the StreamRat payload to the public Downloads directory as update_{timestamp}.apk, then requests permission to install applications from unknown sources. After approval, it installs the payload through Android's package installation mechanism. The payload requests Accessibility access, and after the user grants that permission, the malware connects to its command-and-control server.
ThreatFabric assessed that the VPN interruption—which causes other applications to lose internet connectivity during installation before the dropper shuts it down—may reduce online reputation and code-analysis checks, though Google Play Protect retains offline detection for known potentially harmful applications, limiting the technique's effect on the service. For visible screen capture, StreamRat invokes Android's MediaProjection application programming interface, which displays a consent dialog and is typically identified by a screen-sharing indicator. The malware can use Accessibility to interact with the consent dialog after the victim has granted that permission. A second mode uses the Accessibility takeScreenshot() method to capture the screen outside the MediaProjection indicator. The report notes that users should stop the installation when a streaming app requests system controls unrelated to streaming, as device takeover requires the victim to grant a succession of controls after sideloading the Android Package.
The StreamRat payload came from a GitHub account that ThreatFabric linked to an earlier Mirax campaign, with the dropper closely resembling the one used in that operation. The droppers are hosted using GitHub releases, with different backup links and daily package updates, according to a Cleafy report on Mirax cited in the analysis. ThreatFabric shared indicators of compromise including two SHA-256 hashes for applications named "StrεαmTV Pro" and "Sistema de vídeo," along with two command-and-control IP addresses. The malware's multi-stage installation process—requiring users to grant Home application status, VPN permissions, unknown-source installation rights, and Accessibility access—represents a significant social engineering hurdle, yet the campaign's reach to more than half a million accounts demonstrates that a fraction of targets will complete the sequence when convinced they're installing legitimate streaming software. Organizations should recognize that even sophisticated permission models become vulnerable when adversaries successfully impersonate trusted application categories, turning user education into the critical defensive layer where technical controls alone cannot prevent initial compromise.