Loading story…
Attackers compromised the developer signing keys for the popular open-source SmartTube YouTube client for Android TV, enabling them to distribute a malicious update (version 30.51) to users. The injected malware, concealed as a native library (libalphasdk.so), was not part of the official source code and operated covertly in the background, performing device fingerprinting, registration with a remote backend, and periodic encrypted communications for metrics and configuration retrieval. The breach was detected after users reported Play Protect warnings, prompting the developer, Yuriy Yuliskov, to revoke the compromised keys and announce a new version with a separate app ID.
Users have been advised to avoid updating to the compromised version, disable auto-updates, refrain from using premium accounts, and monitor for unauthorized access or suspicious services. The developer has released safe beta and stable test builds, but the full extent of the compromise remains under investigation. Security experts recommend Google Account credential resets and heightened vigilance for those affected by the malicious update.
Trace attribution and downstream blast radius.
2 events from the most recent confirmed update back to the earliest known activity.
AhnLab ASEC released a public security incident report on the SmartTube compromise and advised users to remain alert for malicious activity related to the app. The report marked a technical and public disclosure of the incident by a security vendor.
The SmartTube app for Android TV was reportedly breached, allowing attackers to inject malware into an app update distributed to users. Multiple sources describe the incident as a supply-chain style compromise affecting the ad-free YouTube client.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceasec.ahnlab.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ThreatFabric identified **StreamRat**, a new Android banking trojan targeting Spanish-speaking users through fraudulent free television-streaming advertisements on Meta platforms and reportedly TikTok. The campaign used a sideloaded APK dropper that pressured victims to grant default Home-app, VPN, unknown-source installation, and Android Accessibility permissions before deploying the final payload. Meta advertisements active from June 11 to July 3 reportedly reached about **570,950 EU accounts**, although no confirmed infections or victims were reported. After Accessibility access is enabled, StreamRat can conduct credential theft through overlays and keylogging, collect UI-tree data, view or capture screens, and remotely operate compromised devices using VNC and hidden-screen control. It also abuses Android MediaProjection and can lock the device or block internet access, enabling operators to take extensive control while obscuring activity from victims. Researchers found infrastructure links to the earlier Mirax campaign but did not attribute StreamRat to a named threat actor.
Sep 3, 2026
Version `3.17.18` of the official APKPure Android app was found to contain malicious code that decrypted and launched a payload at startup, turning the third-party app store itself into a malware delivery channel. The payload collected device information, sent it to a command-and-control server, displayed intrusive advertising, opened browser pages with ads, and could fetch additional executable modules for further activity on infected devices. Researchers observed the app downloading a Trojan resembling **Triada**, a malware family known for ad fraud, forced subscriptions to paid services, and secondary malware delivery. The exposure was especially serious on older Android versions, where the malware could install apps into the system partition and potentially create persistent, hard-to-remove infections similar to **xHelper**. APKPure was reportedly notified on April 8 and addressed the issue by releasing version `3.17.19`.
Aug 14, 2026
Malicious social-media advertisements impersonating a free TV streaming service distributed the **StreamRat** Android banking trojan to Spanish-speaking users in Spain. A Meta advertising campaign active from June 11 to July 3 reportedly reached about 570,000 users; this represents potential exposure rather than confirmed infections. Victims were lured through a staged sideloading process that installed a dropper, persuaded them to set it as the default launcher, and requested high-risk Accessibility permissions before downloading the primary payload. StreamRat abuses Android Accessibility Services, screen capture, and remote-touch capabilities to monitor screens, log keystrokes, capture screenshots, inventory installed apps, and take control of infected devices. It can deploy credential-stealing overlays and hide malicious actions behind black-screen or fake-update displays. The dropper may also request VPN access to temporarily disrupt other applications' internet connectivity while preserving its own connection to retrieve the payload, potentially limiting cloud-based security checks during installation.
Sep 23, 2026