Loading story…
ThreatFabric identified StreamRat, a new Android banking trojan targeting Spanish-speaking users through fraudulent free television-streaming advertisements on Meta platforms and reportedly TikTok. The campaign used a sideloaded APK dropper that pressured victims to grant default Home-app, VPN, unknown-source installation, and Android Accessibility permissions before deploying the final payload. Meta advertisements active from June 11 to July 3 reportedly reached about 570,950 EU accounts, although no confirmed infections or victims were reported.
After Accessibility access is enabled, StreamRat can conduct credential theft through overlays and keylogging, collect UI-tree data, view or capture screens, and remotely operate compromised devices using VNC and hidden-screen control. It also abuses Android MediaProjection and can lock the device or block internet access, enabling operators to take extensive control while obscuring activity from victims. Researchers found infrastructure links to the earlier Mirax campaign but did not attribute StreamRat to a named threat actor.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
ThreatFabric published findings on StreamRat, describing a sideloaded two-stage installer that seeks Home-app, VPN, unknown-source installation, and Accessibility permissions. The final payload can use overlays, keylogging, UI inspection, screen capture, and remote-control functions to take near-complete control of compromised Android devices.
The Meta advertising campaign ended after reaching an estimated 570,950 European Union Meta accounts at least once. Confirmed infections or victim counts were not reported.
ThreatFabric identified the StreamRat campaign in late July 2026. Researchers found delivery-infrastructure and dropper-code links to an earlier Mirax campaign, but did not attribute StreamRat to a named actor.
A fraudulent television-streaming advertising campaign distributing the StreamRat Android banking trojan began targeting Spanish-speaking users on Meta platforms.
Researchers observed the same fraudulent streaming-service advertising banners used to distribute StreamRat through TikTok, in addition to the Meta-platform campaign. The TikTok lures directed Android users toward the device-aware fraudulent site and sideloaded APK.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
8 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemalwarebytes.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcemkd-cirt.mk
Open sourcethehackernews.com
Open sourcemalware.news
Open sourcethreatfabric.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple Android malware operations have been documented using remote access trojans to seize control of victims’ phones, steal sensitive data, and support financial fraud. Reporting on **CraxsRAT** describes a malware family built to give operators broad device access, while separate research identified **Klopatra**, an Android RAT disguised as the IPTV and VPN app **“Modpro IP TV + VPN,”** infecting more than 3,000 devices in Europe and enabling hidden remote control through a black-screen VNC feature. Klopatra also supports banking overlay attacks, gesture simulation, clipboard theft, keystroke capture, and screen monitoring, allowing attackers to conduct credential theft and fraudulent transactions while the device appears inactive. A third investigation found attackers targeting high-value individuals in South Asia with Android malware built on **SpyNote**, delivered through WhatsApp under multiple app names and tied to shared command-and-control infrastructure. That malware was designed to hide itself after installation and collect location data, contacts, SMS messages, call records, device information, files, screenshots, and keystrokes, particularly when accessibility permissions were granted. Across the reported cases, the malware showed strong evasion and persistence features, including obfuscation, anti-debugging, emulator detection, and attempts to disable security tools, underscoring how modern Android RATs are being adapted for espionage, credential theft, and banking abuse.
Jun 29, 2026
Researchers reported active distribution of the Android malware **Mirax**, a remote access trojan that combines banking credential theft with residential proxy functionality, allowing attackers to turn infected phones into **SOCKS5** proxy nodes while harvesting sensitive data. Cleafy said campaigns aimed largely at Spanish-speaking users reached more than **220,000** accounts across Meta platforms including Facebook, Instagram, Messenger, and Threads, using fake IPTV and sports-streaming lures, phishing pages, and **GitHub Releases**-hosted dropper APKs to drive sideloaded infections. Mirax is described as a restricted **malware-as-a-service** offering linked to the underground **"Mirax Bot"** ecosystem and reportedly marketed mainly to trusted Russian-speaking affiliates. Once installed, the malware abuses Android Accessibility Services, deploys credential-theft overlays, and maintains multiple WebSocket command-and-control channels on ports `8443`, `8444`, and `8445`; its use of **SOCKS5**, **Yamux**, and residential IP routing helps attackers evade fraud controls and support follow-on activity such as account takeover, transaction fraud, password spraying, and broader anonymous abuse through victims’ devices.
Jun 29, 2026
Researchers reported two **Telegram-marketed malware-as-a-service (MaaS)** offerings focused on mobile device compromise and surveillance. *ZeroDayRAT* is advertised as a subscription spyware platform claiming full monitoring of **Android and iOS** devices, with infections driven by **smishing** and other social-engineering lures that push victims to malicious links disguised as legitimate apps/updates; delivery chains reportedly use multi-stage redirects, URL shorteners, and in some cases trusted hosting such as *GitHub Pages* to evade reputation-based filtering. Once installed, the operator-facing web panel is advertised to provide extensive monitoring, including device profiling, app-usage timelines, GPS tracking, and remote activation of camera/microphone, plus screen recording and keystroke logging—capabilities consistent with credential theft and broad user surveillance. Separately, Cyble detailed ongoing development of *SURXRAT* (marketed as **SURXRAT V5**) as an Android RAT sold through a structured reseller/partner licensing model that enables affiliates to generate customized builds while the operator retains centralized control. The malware is described as a full-featured surveillance and device-control toolkit that abuses **Android Accessibility** permissions for persistent control and uses **Firebase-backed C2**; code similarities indicate lineage from **ArsinkRAT**. Recent samples were observed conditionally downloading a **large LLM module from Hugging Face**, which researchers assess as experimentation that could enable AI-assisted functionality, deliberate device performance impact, or new monetization approaches alongside established behaviors such as data exfiltration, remote command execution, and ransomware-style device locking.
Jun 29, 2026