Uncovering StreamRat: From Meta Ads to Full Device Takeover

ThreatFabric researchers discovered StreamRat, a sophisticated Android banking trojan distributed through Meta and TikTok advertisements masquerading as a free TV-streaming service targeting Spanish-speaking users, primarily in Spain. The trojan employs a two-stage installation process involving a dropper that disables internet connectivity using non-functional VPN connections. Once installed, StreamRat abuses Accessibility Services and the MediaProjection API to provide operators near-complete device control, enabling VNC and hidden screen control, UI-tree collection, keylogging, credential-stealing overlays, and screen-blocking capabilities. It is offered as Malware-as-a-Service with a sophisticated control panel supporting multiple user roles and WebSocket-based C2 communications. The campaign reached approximately 570,000 potential victims.

StreamRat enables attackers to gain near-total control over infected Android devices, allowing remote control via VNC, hidden screen manipulation, keylogging, credential theft through overlays, UI data collection, and screen blocking. These capabilities facilitate extensive data theft and device manipulation, posing significant risks to user privacy and financial security. The campaign has potentially exposed approximately 570,000 users, primarily in Spain.

No official patch or remediation guidance is currently available. Mitigation should focus on user education to avoid installing applications from untrusted sources or suspicious advertisements. Users should review and restrict Accessibility Service permissions and MediaProjection API usage to trusted applications only. Monitoring for suspicious app installations and unusual network activity may assist in detecting infections. Refer to the ThreatFabric advisory for any updates on mitigation or detection techniques.