- Cybersecurity firm ThreatFabric uncovered a new Android banking trojan called StreamRat, spread via fake TV-streaming ads on Meta that reached nearly 571,000 EU accounts.
- The malware requires victims to sideload an APK and grant multiple permissions, including Accessibility, enabling full device takeover and credential theft.
- StreamRat’s dropper temporarily disables internet access via a VPN to evade analysis, then fetches the payload from GitHub, linking the campaign to the earlier Mirax operation.
Security researchers have disclosed details of a new Android banking trojan called StreamRat, promoted to Spanish-speaking users through a fake television-streaming campaign on Meta that reached an estimated 570,950 accounts in the European Union. ThreatFabric, which analyzed the malware, stated that “there is little doubt that StreamRat is a new and technically sophisticated threat, developed by individuals with prior experience in the Android malware ecosystem.”
Device takeover begins when a victim downloads a sideloaded APK from a specially crafted website after clicking a social-media ad. The dropper first requests to become the default Home application, then asks for VPN permission to route all traffic through a nonfunctional interface, cutting off internet for other apps. Once the victim grants Accessibility access, the malware connects to its command-and-control server and can capture keystrokes, display phishing overlays, and remotely control the device.
The campaign ran from June 11 to July 3, 2026, and was identified in late July. ThreatFabric also found evidence that StreamRat was promoted on TikTok, though no ad reach figures were provided. The payload originated from a GitHub account linked to an earlier Mirax campaign, and the dropper closely resembled the one used in that operation. As detailed in Cleafy’s Mirax report, the droppers are hosted using GitHub releases with different backup links and daily package updates.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
