ThreatFabric reports StreamRat Android banking trojan via Meta ads

Researchers at ThreatFabric have discovered a new Android banking trojan called StreamRat, which was distributed through a fake advertising campaign for a streaming service on Meta. According to the researchers, the campaign targeted Spanish-speaking users in Spain and reached approximately 570,950 Meta accounts in the European Union. It is important to emphasize that this figure reflects advertising reach, not the number of infections — the number of compromised devices and confirmed victims has not been disclosed. Android users who install apps from third-party sources should immediately check their devices for the indicators of compromise listed below.

Infection chain: from ad banner to full control

The attack starts with an ad on Meta that redirects the user to a specially crafted website. The site detects the visitor’s operating system and only offers a download to Android users. The victim downloads an app.apk file that acts as a dropper — an intermediate component that delivers the main malicious payload.

The dropper sequentially requests a number of critical permissions from the user, each of which expands its control over the device:

1. Default home app role. Once approved, the dropper’s interface is displayed every time the Home button is pressed, in accordance with the documented Android Home Role mechanism.
2. VPN connection. The dropper creates a non-functional VPN interface that intercepts the traffic of all applications except the dropper itself. According to the Android VpnService documentation, the platform supports exclusion lists for applications — this is the mechanism being abused. As a result, other apps lose internet access during installation, which, in ThreatFabric’s assessment, may reduce the effectiveness of online reputation checks and code analysis.
3. Installation from unknown sources. The dropper downloads the main StreamRat payload into the public Downloads directory as update_{timestamp}.apk and requests permission to install applications from third-party sources, which has been mandatory since Android 8.0.
4. Access to the Accessibility Service. After StreamRat is installed, it requests access to the accessibility service, after which it establishes a connection to its command-and-control (C2) server.

After the VPN interface is disabled, StreamRat obtains full network access to communicate with the C2 server.

Trojan capabilities

According to ThreatFabric, once it gains access to the Accessibility Service, the trojan acquires the following capabilities:

• Keylogging
• Displaying phishing overlays to steal credentials
• Inspecting the contents of the visible user interface
• Remote device control

Its dual screen-capture mechanism deserves special attention. The first mode uses the Android MediaProjection API, which requires user consent and shows a screen-recording indicator. However, with Accessibility access, the malware can automatically interact with the consent dialog. The second mode relies on the AccessibilityService.takeScreenshot() method, available starting from API level 30, which allows screenshots to be taken without the MediaProjection indicator.

Campaign context

The Meta advertising campaign reportedly ran from June 11 to July 3, 2026. Researchers identified it in late July, and the analysis results were published on September 2, 2026. The specific threat actor has not been identified — ThreatFabric has not attributed the campaign to any known group.

The researchers also mention possible distribution via TikTok; however, the evidence presented is limited to landing page code capable of detecting TikTok as the referrer. No ad records or reach metrics on TikTok were provided, so this distribution channel should be regarded as unconfirmed.

The range of vulnerable Android versions has not been published — the threat’s applicability is determined by user behavior during installation and when granting permissions.

Indicators of compromise

ThreatFabric has provided the following indicators (reproduced from the report without independent validation):

• SHA-256:e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c
• Package: io.base.one887 / Application: StrεαmTV Pro
• SHA-256:ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3
• Package: io.meat.hint / Application: Sistema de vídeo
• C2: 45.147.28[.]59, 193.32.2[.]245

Recommendations for protection

• Do not install APKs from third-party sources. StreamRat is distributed exclusively via sideloading — the Google Play Store is not involved. Disable the permission to install from unknown sources for all apps in your security settings.
• Critically evaluate requested permissions. A streaming app that requests the home screen role, VPN access, or Accessibility Service is an obvious sign of malicious activity.
• Check installed applications. Look for the packages io.base.one887 and io.meat.hint via device settings or ADB. If found, delete them immediately and change passwords for all banking and financial services.
• Block the C2 addresses at the network equipment or MDM-solution level: 45.147.28[.]59 and 193.32.2[.]245.
• Make sure Google Play Protect is enabled. The service can still detect known malicious apps offline, which partially offsets the dropper’s VPN manipulation.

StreamRat showcases a carefully designed multi-stage infection chain in which each step relies on legitimate Android mechanisms — from home screen control to VPN routing. The key protective barrier remains simple: refuse to install APK files downloaded via advertising links in social networks. Organizations with fleets of Android devices are advised to add the specified hashes and IP addresses to detection rules and to block sideloading via mobile device management policies.