Loading story…
Malicious social-media advertisements impersonating a free TV streaming service distributed the StreamRat Android banking trojan to Spanish-speaking users in Spain. A Meta advertising campaign active from June 11 to July 3 reportedly reached about 570,000 users; this represents potential exposure rather than confirmed infections. Victims were lured through a staged sideloading process that installed a dropper, persuaded them to set it as the default launcher, and requested high-risk Accessibility permissions before downloading the primary payload.
StreamRat abuses Android Accessibility Services, screen capture, and remote-touch capabilities to monitor screens, log keystrokes, capture screenshots, inventory installed apps, and take control of infected devices. It can deploy credential-stealing overlays and hide malicious actions behind black-screen or fake-update displays. The dropper may also request VPN access to temporarily disrupt other applications' internet connectivity while preserving its own connection to retrieve the payload, potentially limiting cloud-based security checks during installation.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
A malicious-advertising campaign promoting a purported free streaming service targeted Spanish-speaking Android users in Spain and reached approximately 570,000 Meta users. The reach figure covered June 11 through July 3, 2026, and does not represent confirmed infections.
Researchers documented that StreamRat uses a sideloaded dropper, default-home-screen abuse, Accessibility permissions, screen capture, phishing overlays, and remote touch actions to control Android devices. They also identified VPN-related behavior that can temporarily disrupt other applications' connectivity while the dropper downloads the payload.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ThreatFabric identified **StreamRat**, a new Android banking trojan targeting Spanish-speaking users through fraudulent free television-streaming advertisements on Meta platforms and reportedly TikTok. The campaign used a sideloaded APK dropper that pressured victims to grant default Home-app, VPN, unknown-source installation, and Android Accessibility permissions before deploying the final payload. Meta advertisements active from June 11 to July 3 reportedly reached about **570,950 EU accounts**, although no confirmed infections or victims were reported. After Accessibility access is enabled, StreamRat can conduct credential theft through overlays and keylogging, collect UI-tree data, view or capture screens, and remotely operate compromised devices using VNC and hidden-screen control. It also abuses Android MediaProjection and can lock the device or block internet access, enabling operators to take extensive control while obscuring activity from victims. Researchers found infrastructure links to the earlier Mirax campaign but did not attribute StreamRat to a named threat actor.
Sep 3, 2026
Multiple Android malware operations have been documented using remote access trojans to seize control of victims’ phones, steal sensitive data, and support financial fraud. Reporting on **CraxsRAT** describes a malware family built to give operators broad device access, while separate research identified **Klopatra**, an Android RAT disguised as the IPTV and VPN app **“Modpro IP TV + VPN,”** infecting more than 3,000 devices in Europe and enabling hidden remote control through a black-screen VNC feature. Klopatra also supports banking overlay attacks, gesture simulation, clipboard theft, keystroke capture, and screen monitoring, allowing attackers to conduct credential theft and fraudulent transactions while the device appears inactive. A third investigation found attackers targeting high-value individuals in South Asia with Android malware built on **SpyNote**, delivered through WhatsApp under multiple app names and tied to shared command-and-control infrastructure. That malware was designed to hide itself after installation and collect location data, contacts, SMS messages, call records, device information, files, screenshots, and keystrokes, particularly when accessibility permissions were granted. Across the reported cases, the malware showed strong evasion and persistence features, including obfuscation, anti-debugging, emulator detection, and attempts to disable security tools, underscoring how modern Android RATs are being adapted for espionage, credential theft, and banking abuse.
Jun 29, 2026
Researchers documented **RatHat**, an Android banking trojan and remote-access tool tentatively linked to China-based operators. Distributed through smishing, malvertising, deceptive download sites, third-party forums, and trojanized APKs, it abuses Android Accessibility services to enable Wireless Debugging, pair with the device-local ADB daemon, and obtain shell-level execution. RatHat deploys external Go-based daemons and an FRP reverse-proxy client, creating persistence that can survive APK removal and maintaining remote access through NAT and firewall restrictions. The malware targets banking credentials and authentication data through fraudulent payment overlays, Accessibility-driven text capture, SMS and notification interception for OTP theft, screen capture, and raw `/dev/input` touch-event collection that can reconstruct PINs and unlock patterns. It also supports AI-assisted UI automation and uses HTTP, WebSocket, and persistent FRP tunnels for command-and-control. Defenses against analysis include malformed APK and manifest structures, DEX poisoning, encrypted strings, and checks for debuggers, Frida, Xposed, rooted devices, and emulators.
Sep 22, 2026