Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control

1. Executive summary

ThreatFabric has disclosed a new Android banking trojan, StreamRat, distributed through a fake television-streaming ad campaign on Meta platforms targeting Spanish-speaking users, with the advertisement reaching an estimated 570,950 Meta accounts in the EU (Spain focus). The malware is delivered via a dropper APK that progressively requests device default Home application status, VPN permission, unknown-sources installation permission, and Accessibility access, after which operators gain near-complete device control including keystroke capture, credential-stealing overlays, screen capture, and remote device control. No CISA-KEV exploitation state applies — this is a malware campaign, not a CVE-driven vulnerability — and no CVSS score is assigned in the verified reference data. Attribution is unconfirmed: ThreatFabric did not attribute the campaign to a named threat actor. EMEA financial services with retail customers in Spain and Spanish-speaking markets face direct overlay-based credential-theft and session-hijacking risk against mobile banking apps; infected-device counts and confirmed victim figures remain unreported.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain (per ThreatFabric's analysis)

1. Initial access: A social-media lure (Meta ad campaign; also evidence of TikTok-referred traffic) directs an Android user to a specially crafted website. The site checks the visitor's operating system and displays its download button only to Android devices.
2. Dropper download: The victim downloads a file named app.apk and launches it.
3. Home-app persistence: The dropper asks to become the device's default Home application, returning the victim to the dropper's interface whenever the Home button is pressed.
4. VPN permission: Before fetching the payload, the dropper requests permission to establish a VPN connection. Once approved, the VPN routes device traffic into a nonfunctional interface while excluding the dropper itself.
5. Payload download: The dropper's main page downloads the StreamRat payload to the public Downloads directory as update_{timestamp}.apk.
6. Unknown-sources install: The dropper requests permission to install applications from unknown sources, then installs the payload through Android's package installation mechanism.
7. Accessibility grant: StreamRat launches and requests Accessibility access. Once granted, the malware connects to its C2 server.
8. VPN teardown: The dropper shuts down the VPN after the payload executes, restoring connectivity so StreamRat can communicate with its C2.

Technical specifics relevant to defenders

• VPN-as-analysis-evasion: The nonfunctional VPN interface causes other applications to lose internet connectivity during installation. ThreatFabric assessed this may reduce online reputation and code-analysis checks (e.g., cloud-based APK scanning). Google Play Protect retains offline detection for known potentially harmful applications (PHAs), limiting the technique's effect on that service.
• Screen capture, two modes: (a) StreamRat invokes Android's MediaProjection API, which displays a consent dialog and is typically identified by a screen-sharing indicator; the malware can use Accessibility to interact with the consent dialog after the victim has granted that permission. (b) A second mode uses the Accessibility takeScreenshot() method to capture the screen outside the MediaProjection indicator — i.e., without the screen-sharing indicator visible to the user.
• Post-Accessibility capabilities: Once Accessibility access is enabled, operators can capture keystrokes, display credential-stealing overlays, inspect the visible interface, and control the device remotely.
• Distribution scope: The Meta advertisement focused on Spain and reached an estimated 570,950 EU Meta accounts that saw it at least once. The same banners were likely displayed on Facebook and Instagram; the primary Meta placement remains undetermined. StreamRat was also promoted through TikTok — however, the TikTok-specific public evidence consisted only of landing-page code that can identify TikTok as the referring application; no TikTok ad record or reach figure was supplied.
• Applicability: Tied to installation behavior and requested permissions; no Android version range was published.

Confidence caveats: All technical detail in this section is single-sourced — it derives from ThreatFabric's StreamRat analysis as reported by The Hacker News. No second vendor has corroborated the campaign, the malware capabilities, or the IOC set; verify before enforcement. Attribution is unconfirmed: ThreatFabric did not attribute the campaign to a named threat actor, and no MITRE ATT&CK actor profile exists in the verified reference data. Infected-device totals and confirmed victim counts remain unreported.

4. Mitigation & containment

P1 — within 24 hours

• Alert mobile fraud/anti-fraud and SOC teams on the campaign: Spanish-language fake TV-streaming app lures ("StrεαmTV Pro", "Sistema de…" app family) delivered via Meta/Facebook/Instagram ads and TikTok-referred landing pages.
• Hunt enterprise-managed Android estates for the known malicious packages: io.base.one887 and io.meat.hint (see §5 hashes). Blocklist both package names in MDM/EMM application policies.
• Review recent mobile-banking fraud alerts and customer complaints for Spain-based or Spanish-language customers reporting: inability to use other apps' internet connectivity during an app install, unexpected default Home app changes, unexpected VPN profiles, or screen-sharing indicators during banking sessions.
• Ensure Google Play Protect is enabled and not disabled on managed devices; its offline PHA detection partially mitigates the VPN-based analysis evasion.

P2 — within 72 hours

• Add the §5 SHA-256 hashes to EDR/mobile-threat-defence blocklists and retro-hunt across managed device fleets.
• Brief customer-facing teams: advise customers to stop installation when a streaming app requests system controls unrelated to streaming (Home app, VPN, unknown-sources install, Accessibility). This is the key user-side kill point — the chain requires the victim to grant each control in succession.
• Review mobile banking app hardening: detect Accessibility-service enablement while the banking app is in the foreground, and detect MediaProjection sessions initiated during banking sessions; consider step-up authentication on sessions where screen-sharing indicators are active.
• If customer infections are confirmed, trigger the DORA Art. 18 classification process and evaluate Art. 19 major-incident reporting; NIS2 in-scope entities should assess the Art. 23 early-warning/notification windows.

P3 — within 7 days

• Monitor for copycat droppers: the update_{timestamp}.apk naming pattern in the public Downloads directory and the permission-sequence (Home app → VPN → unknown sources → Accessibility) are the campaign's structural signature, independent of the specific package names.
• Track ThreatFabric and peer-vendor publications for follow-up IOCs, victim figures, and any attribution update; the current picture is single-sourced.

5. Indicators of compromise

Note: the second application label is truncated in the source material ("Sistema de…"); it is reproduced as-is and should not be used as a complete match string. All indicators are single-sourced from ThreatFabric's report; verify before enforcement.

sha256  e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c
package  io.base.one887
application  StrεαmTV Pro
sha256  ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3
package  io.meat.hint
application  Sistema de

Behavioural indicators

6. Detection

rule ANDROID_StreamRat_Dropper_Payload {
    meta:
        author = "Adverse Trace"
        date = "2026-09-02"
        reference = "https://thehackernews.com/2026/09/meta-ads-push-streamrat-android-trojan.html"
        description = "Detects StreamRat Android dropper/payload APKs by package name and app label"
    strings:
        $pkg1 = "io.base.one887" ascii
        $pkg2 = "io.meat.hint" ascii
        $app1 = "Str\xCE\xB5\xCE\xB1mTV Pro" ascii
        $file1 = "update_" ascii
        $file2 = ".apk" ascii
    condition:
        uint32(0) == 0x04034b50 or filesize < 50MB
        and (
            2 of ($pkg1, $pkg2, $app1)
            or ($file1 and $file2)
        )
}

Note: the $app1 string encodes the Greek epsilon and alpha characters in "StrεαmTV Pro" as UTF-8 bytes; verify byte encoding against a sample before production deployment. The update_ + .apk pair alone is weak (generic naming pattern) — treat matches on that pair as low-confidence and corroborate with package names or the §5 hashes.

title: Android device - StreamRat-like permission chain on sideloaded streaming app
id: 8f3c1a52-7d94-4e11-9b02-6a5e0c7f2d41
status: experimental
description: >
    Detects the StreamRat installation chain: a sideloaded APK requesting default
    Home app status, VPN permission, unknown-sources install, and Accessibility
    access in succession, followed by an update_*.apk write to Downloads.
references:

    - https://thehackernews.com/2026/09/meta-ads-push-streamrat-android-trojan.html
author: Adverse Trace
date: 2026/09/02
tags:

    - attack.persistence
    - attack.collection
    - attack.t1480
logsource:
    product: android
    service: mdm/emm telemetry
detection:
    selection_home:
        EventID|contains:

            - 'default_home_app_change'
    selection_vpn:
        EventID|contains:

            - 'vpn_service_enabled'
    selection_install:
        EventID|contains:

            - 'install_unknown_sources_enabled'
    selection_accessibility:
        EventID|contains:

            - 'accessibility_service_enabled'
    selection_download:
        TargetFilename|startswith: '/storage/emulated/0/Download/update_'
        TargetFilename|endswith: '.apk'
    condition: 3 of selection_*
falsepositives:

    - Legitimate VPN apps requesting VPN permission
    - Legitimate accessibility tools
    - Any app writing update_*.apk to Downloads (common updater pattern)
level: high

Note: the Sigma rule encodes the permission-sequence behaviour described in the source; map the EventID values to your MDM/EMM vendor's actual event identifiers. The condition: 3 of selection_* requires three of the four permission-chain events plus is weighted toward the Downloads write; tune per environment.

7. Sources

• The Hacker News, "Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control," https://thehackernews.com/2026/09/meta-ads-push-streamrat-android-trojan.html, 2026-09-02
• ThreatFabric (original research, as cited by The Hacker News), StreamRat analysis, 2026-09-02

8. Adverse Trace position

StreamRat is a technically capable Android banking trojan with a well-engineered, multi-stage social-engineering and permission-abuse chain, but the current picture is entirely single-sourced from ThreatFabric's analysis — no second vendor has corroborated the campaign, capabilities, or IOCs, and attribution is unconfirmed with no named actor. The ~570,950 EU ad-reach figure indicates significant exposure in Spain specifically, making Spanish-language retail banking customers the primary at-risk population for EMEA financial services clients; the overlay/keylogging/remote-control capability set is a direct credential-theft and session-hijacking threat to mobile banking, and the Accessibility-based takeScreenshot() mode captures screens without the standard indicator, defeating a common user-side detection cue. No CVSS score or CISA-KEV state applies to this item. We assess the risk to clients as material but unquantified — infected-device and victim counts are unreported — and we will monitor for corroborating vendor reporting, additional IOCs, attribution developments, and any Meta/TikTok platform enforcement action, and will reissue this advisory if the single-source status changes or victim data emerges.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.