> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control - URL: https://f4n6.co.uk/security-feed/meta-ads-push-streamrat-android-trojan-that-can-gain-near-complete-device-control/ - Published: 2026-09-02T14:06:43.000Z - Updated: 2026-09-02T14:06:43.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary ThreatFabric has disclosed a new Android banking trojan, StreamRat, distributed through a fake television-streaming ad campaign on Meta platforms targeting Spanish-speaking users, with the advertisement reaching an estimated 570,950 Meta accounts in the EU (Spain focus). The malware is delivered via a dropper APK that progressively requests device default Home application status, VPN permission, unknown-sources installation permission, and Accessibility access, after which operators gain near-complete device control including keystroke capture, credential-stealing overlays, screen capture, and remote device control. No CISA-KEV exploitation state applies — this is a malware campaign, not a CVE-driven vulnerability — and no CVSS score is assigned in the verified reference data. Attribution is unconfirmed: ThreatFabric did not attribute the campaign to a named threat actor. EMEA financial services with retail customers in Spain and Spanish-speaking markets face direct overlay-based credential-theft and session-hijacking risk against mobile banking apps; infected-device counts and confirmed victim figures remain unreported. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 18: classification of ICT-related incidents and cyber threats | A large-scale social-media-ad-delivered Android banking trojan campaign specifically targeting customers in Spain, an EU member state, with EU-wide ad reach of \~570,950 accounts | Financial entities must classify this campaign as a cyber threat within their ICT incident classification process and assess whether any customer-side infections constitute reportable incidents | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | The campaign is designed to steal banking credentials and take over customer devices via overlays and keylogging, with victim counts currently unreported | Entities that identify affected customers must evaluate whether the incident meets major-incident thresholds and report to competent authorities within prescribed timelines | | NIS2 Art. 23: incident reporting obligations | For NIS2 in-scope entities, customer-device compromise via this campaign may constitute a significant incident affecting service users | Assess and report significant incidents within the 24-hour early warning and 72-hour notification windows where thresholds are met | ## 3\. Technical analysis & attack chain ### Confirmed attack chain (per ThreatFabric's analysis) 1. **Initial access:** A social-media lure (Meta ad campaign; also evidence of TikTok-referred traffic) directs an Android user to a specially crafted website. The site checks the visitor's operating system and displays its download button only to Android devices. 2. **Dropper download:** The victim downloads a file named `app.apk` and launches it. 3. **Home-app persistence:** The dropper asks to become the device's default Home application, returning the victim to the dropper's interface whenever the Home button is pressed. 4. **VPN permission:** Before fetching the payload, the dropper requests permission to establish a VPN connection. Once approved, the VPN routes device traffic into a nonfunctional interface while excluding the dropper itself. 5. **Payload download:** The dropper's main page downloads the StreamRat payload to the public Downloads directory as `update_{timestamp}.apk`. 6. **Unknown-sources install:** The dropper requests permission to install applications from unknown sources, then installs the payload through Android's package installation mechanism. 7. **Accessibility grant:** StreamRat launches and requests Accessibility access. Once granted, the malware connects to its C2 server. 8. **VPN teardown:** The dropper shuts down the VPN after the payload executes, restoring connectivity so StreamRat can communicate with its C2. ### Technical specifics relevant to defenders - **VPN-as-analysis-evasion:** The nonfunctional VPN interface causes other applications to lose internet connectivity during installation. ThreatFabric assessed this may reduce online reputation and code-analysis checks (e.g., cloud-based APK scanning). Google Play Protect retains offline detection for known potentially harmful applications (PHAs), limiting the technique's effect on that service. - **Screen capture, two modes:** (a) StreamRat invokes Android's MediaProjection API, which displays a consent dialog and is typically identified by a screen-sharing indicator; the malware can use Accessibility to interact with the consent dialog after the victim has granted that permission. (b) A second mode uses the Accessibility `takeScreenshot()` method to capture the screen outside the MediaProjection indicator — i.e., without the screen-sharing indicator visible to the user. - **Post-Accessibility capabilities:** Once Accessibility access is enabled, operators can capture keystrokes, display credential-stealing overlays, inspect the visible interface, and control the device remotely. - **Distribution scope:** The Meta advertisement focused on Spain and reached an estimated 570,950 EU Meta accounts that saw it at least once. The same banners were likely displayed on Facebook and Instagram; the primary Meta placement remains undetermined. StreamRat was also promoted through TikTok — however, the TikTok-specific public evidence consisted only of landing-page code that can identify TikTok as the referring application; no TikTok ad record or reach figure was supplied. - **Applicability:** Tied to installation behavior and requested permissions; no Android version range was published. **Confidence caveats:** All technical detail in this section is single-sourced — it derives from ThreatFabric's StreamRat analysis as reported by The Hacker News. No second vendor has corroborated the campaign, the malware capabilities, or the IOC set; verify before enforcement. Attribution is unconfirmed: ThreatFabric did not attribute the campaign to a named threat actor, and no MITRE ATT&CK actor profile exists in the verified reference data. Infected-device totals and confirmed victim counts remain unreported. ## 4\. Mitigation & containment ### P1 — within 24 hours - Alert mobile fraud/anti-fraud and SOC teams on the campaign: Spanish-language fake TV-streaming app lures ("StrεαmTV Pro", "Sistema de…" app family) delivered via Meta/Facebook/Instagram ads and TikTok-referred landing pages. - Hunt enterprise-managed Android estates for the known malicious packages: `io.base.one887` and `io.meat.hint` (see §5 hashes). Blocklist both package names in MDM/EMM application policies. - Review recent mobile-banking fraud alerts and customer complaints for Spain-based or Spanish-language customers reporting: inability to use other apps' internet connectivity during an app install, unexpected default Home app changes, unexpected VPN profiles, or screen-sharing indicators during banking sessions. - Ensure Google Play Protect is enabled and not disabled on managed devices; its offline PHA detection partially mitigates the VPN-based analysis evasion. ### P2 — within 72 hours - Add the §5 SHA-256 hashes to EDR/mobile-threat-defence blocklists and retro-hunt across managed device fleets. - Brief customer-facing teams: advise customers to stop installation when a streaming app requests system controls unrelated to streaming (Home app, VPN, unknown-sources install, Accessibility). This is the key user-side kill point — the chain requires the victim to grant each control in succession. - Review mobile banking app hardening: detect Accessibility-service enablement while the banking app is in the foreground, and detect MediaProjection sessions initiated during banking sessions; consider step-up authentication on sessions where screen-sharing indicators are active. - If customer infections are confirmed, trigger the DORA Art. 18 classification process and evaluate Art. 19 major-incident reporting; NIS2 in-scope entities should assess the Art. 23 early-warning/notification windows. ### P3 — within 7 days - Monitor for copycat droppers: the `update_{timestamp}.apk` naming pattern in the public Downloads directory and the permission-sequence (Home app → VPN → unknown sources → Accessibility) are the campaign's structural signature, independent of the specific package names. - Track ThreatFabric and peer-vendor publications for follow-up IOCs, victim figures, and any attribution update; the current picture is single-sourced. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | ----------- | ---------------------------------------------------------------- | ----------------------------------------------------------------------- | -------------------------------- | | sha256 | e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c | Medium — single-sourced | ThreatFabric via The Hacker News | | package | io.base.one887 | Medium — single-sourced | ThreatFabric via The Hacker News | | application | StrεαmTV Pro | Medium — single-sourced | ThreatFabric via The Hacker News | | sha256 | ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3 | Medium — single-sourced | ThreatFabric via The Hacker News | | package | io.meat.hint | Medium — single-sourced | ThreatFabric via The Hacker News | | application | Sistema de | Low — truncated in source; do not treat as a complete application label | ThreatFabric via The Hacker News | Note: the second application label is truncated in the source material ("Sistema de…"); it is reproduced as-is and should not be used as a complete match string. All indicators are single-sourced from ThreatFabric's report; verify before enforcement. ```iocs sha256 e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c package io.base.one887 application StrεαmTV Pro sha256 ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3 package io.meat.hint application Sistema de ``` ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ---------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ----------------------------------------------- | | App requests to become default Home application immediately after first launch of a sideloaded streaming APK | Android device logs, MDM policy-change events, user reports | High — described in source | | VPN profile created that routes traffic into a nonfunctional interface, excluding the requesting app; other apps lose connectivity | Android VPN service logs, MDM, user complaints of app-wide connectivity loss | High — described in source | | File update\_{timestamp}.apk written to public Downloads directory by a sideloaded app | Downloads directory monitoring, MDM file-integrity policies | High — described in source | | Accessibility service enabled for a newly installed streaming/TV app | Android Accessibility settings change events, EMM compliance policies | High — described in source | | MediaProjection consent dialog auto-interacted-with via Accessibility; screen-sharing indicator appears during banking app use | Device telemetry, banking app session telemetry | High — described in source | | Screen capture via Accessibility takeScreenshot() with NO MediaProjection indicator visible | Requires on-device analysis / mobile threat defence | Medium — described in source, harder to observe | ## 6\. Detection ```yara rule ANDROID_StreamRat_Dropper_Payload { meta: author = "Adverse Trace" date = "2026-09-02" reference = "https://thehackernews.com/2026/09/meta-ads-push-streamrat-android-trojan.html" description = "Detects StreamRat Android dropper/payload APKs by package name and app label" strings: $pkg1 = "io.base.one887" ascii $pkg2 = "io.meat.hint" ascii $app1 = "Str\xCE\xB5\xCE\xB1mTV Pro" ascii $file1 = "update_" ascii $file2 = ".apk" ascii condition: uint32(0) == 0x04034b50 or filesize < 50MB and ( 2 of ($pkg1, $pkg2, $app1) or ($file1 and $file2) ) } ``` Note: the `$app1` string encodes the Greek epsilon and alpha characters in "StrεαmTV Pro" as UTF-8 bytes; verify byte encoding against a sample before production deployment. The `update_` \+ `.apk` pair alone is weak (generic naming pattern) — treat matches on that pair as low-confidence and corroborate with package names or the §5 hashes. ```yaml title: Android device - StreamRat-like permission chain on sideloaded streaming app id: 8f3c1a52-7d94-4e11-9b02-6a5e0c7f2d41 status: experimental description: > Detects the StreamRat installation chain: a sideloaded APK requesting default Home app status, VPN permission, unknown-sources install, and Accessibility access in succession, followed by an update_*.apk write to Downloads. references: - https://thehackernews.com/2026/09/meta-ads-push-streamrat-android-trojan.html author: Adverse Trace date: 2026/09/02 tags: - attack.persistence - attack.collection - attack.t1480 logsource: product: android service: mdm/emm telemetry detection: selection_home: EventID|contains: - 'default_home_app_change' selection_vpn: EventID|contains: - 'vpn_service_enabled' selection_install: EventID|contains: - 'install_unknown_sources_enabled' selection_accessibility: EventID|contains: - 'accessibility_service_enabled' selection_download: TargetFilename|startswith: '/storage/emulated/0/Download/update_' TargetFilename|endswith: '.apk' condition: 3 of selection_* falsepositives: - Legitimate VPN apps requesting VPN permission - Legitimate accessibility tools - Any app writing update_*.apk to Downloads (common updater pattern) level: high ``` Note: the Sigma rule encodes the permission-sequence behaviour described in the source; map the `EventID` values to your MDM/EMM vendor's actual event identifiers. The `condition: 3 of selection_*` requires three of the four permission-chain events plus is weighted toward the Downloads write; tune per environment. ## 7\. Sources - The Hacker News, "Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control," https://thehackernews.com/2026/09/meta-ads-push-streamrat-android-trojan.html, 2026-09-02 - ThreatFabric (original research, as cited by The Hacker News), StreamRat analysis, 2026-09-02 ## 8\. Adverse Trace position StreamRat is a technically capable Android banking trojan with a well-engineered, multi-stage social-engineering and permission-abuse chain, but the current picture is entirely single-sourced from ThreatFabric's analysis — no second vendor has corroborated the campaign, capabilities, or IOCs, and attribution is unconfirmed with no named actor. The \~570,950 EU ad-reach figure indicates significant exposure in Spain specifically, making Spanish-language retail banking customers the primary at-risk population for EMEA financial services clients; the overlay/keylogging/remote-control capability set is a direct credential-theft and session-hijacking threat to mobile banking, and the Accessibility-based `takeScreenshot()` mode captures screens without the standard indicator, defeating a common user-side detection cue. No CVSS score or CISA-KEV state applies to this item. We assess the risk to clients as material but unquantified — infected-device and victim counts are unreported — and we will monitor for corroborating vendor reporting, additional IOCs, attribution developments, and any Meta/TikTok platform enforcement action, and will reissue this advisory if the single-source status changes or victim data emerges. --- [Read the original source →](https://thehackernews.com/2026/09/meta-ads-push-streamrat-android-trojan.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*