"There is little doubt that StreamRat is a new and technically sophisticated threat, developed by individuals with prior experience in the Android malware ecosystem," ThreatFabric said.
ThreatFabric's findings and timeline
Security firm ThreatFabric published an analysis on September 2, 2026, describing StreamRat, a new Android banking trojan that can grant operators near-complete control of infected devices. The campaign used paid social-media advertising and focused on Spain; ThreatFabric estimated that 570,950 Meta accounts in the European Union saw the ad at least once. The campaign ran from June 11, 2026, until July 3, 2026, and was identified in late July 2026. ThreatFabric did not attribute the campaign to a named threat actor.
How the Meta and TikTok ad campaign delivered the malware
The social-media lure directed Android users to a crafted landing page that checked the visitor's operating system and displayed a download button only to Android devices. ThreatFabric said the same banners were likely displayed on Facebook and Instagram; the primary Meta placement remained undetermined. The report also identified TikTok-specific landing-page code that can indicate TikTok as the referrer, though ThreatFabric supplied no TikTok ad record or reach figure.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleDropper behavior: sideloading, Home takeover, and a fake VPN
The initial APK distributed from the site was named app.apk and functioned as a dropper. After the victim launched the APK, the dropper requested to become the device's default Home application so pressing Home would return the user to its interface. Before fetching the final payload, the dropper asked permission to establish a VPN connection. Once approved, the VPN routed device traffic into a nonfunctional interface while excluding the dropper itself; the interface forwarded no routed traffic and caused other applications to lose internet connectivity during installation. ThreatFabric assessed that the interruption may reduce online reputation and code-analysis checks, although Google Play Protect retains offline detection for known potentially harmful applications, which limits the technique's effect on that service.
Installation chain and persistence mechanisms
The dropper downloaded the StreamRat payload to the public Downloads directory under a filename formatted as update_{{timestamp}}.apk, then requested permission to install applications from unknown sources and used Android's package installer to install the payload. The payloads observed included applications named StrεαmTV Pro and Sistema de vídeo with package names io.base.one887 and io.meat.hint. After installation, StreamRat requested Accessibility access; once that permission is granted, the malware connected to command-and-control servers.
Capabilities once Accessibility and screen capture are granted
With Accessibility access enabled, operators can capture keystrokes, display credential‑stealing overlays, inspect the visible interface, and control the device remotely. For visible screen capture, StreamRat invoked Android's MediaProjection API, which displays a consent dialog and is typically identified by a screen‑sharing indicator. ThreatFabric said the malware can interact with that consent dialog via Accessibility after the victim has granted MediaProjection. A second mode uses Accessibility's takeScreenshot() method to capture the screen outside the MediaProjection indicator.
Indicators of compromise and links to earlier campaigns
- SHA-256: e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c
- Package: io.base.one887
- Application: StrεαmTV Pro
- SHA-256: ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3
- Package: io.meat.hint
- Application: Sistema de vídeo
- C2 IP: 45.147.28[.]59
- C2 IP: 193.32.2[.]245
ThreatFabric linked the StreamRat payload to a GitHub account that it connected to an earlier Mirax campaign, and noted the dropper closely resembled the one used in that operation. In a separate Mirax report, Cleafy observed: "The droppers are hosted using GitHub releases, with different backup links and daily package updates."
What this means for end users, security teams, and regulators
- End users: ThreatFabric's advisory urges users to stop installation if a streaming app requests system controls unrelated to streaming. The presence of a MediaProjection consent dialog or an unexpected screen‑sharing indicator is a visible sign to check.
- Security teams and technologists: The provided IoCs (SHA‑256 hashes, package names, application names, and C2 IPs) offer concrete artifacts for detection and blocking. The dropper's use of GitHub releases and daily package updates is a distribution pattern to monitor.
- Regulators and platform operators: The campaign's use of paid social advertising on Meta platforms and the apparent TikTok referral mechanism highlight channels that attracted a wide EU audience—570,950 Meta accounts were exposed at least once—and that may warrant platform-level review of ad placements and landing-page vetting.
StreamRat demonstrates a multi-stage sideloading chain that pairs social advertising with a dropper designed to seize control of critical OS features. The campaign reached large numbers of users in the EU over a three‑week window, used GitHub-hosted droppers linked to an earlier Mirax operation, and left key questions open in public reporting—most notably how many devices were ultimately infected or how many victims were confirmed. Those unanswered totals, combined with the trojan's ability to bypass visible indicators in a second screenshot mode, are the concrete risks defenders will have to guard against now.
