Uncovering StreamRat: From Meta Ads to Full Device Takeover
ThreatFabric researchers discovered StreamRat, a sophisticated Android banking trojan distributed through Meta and TikTok advertisements disguised as a free TV-streaming service targeting Spanish-speaking users. The campaign reached approximately 570,000 potential victims, primarily in Spain. StreamRat employs a two-stage installation process, utilizing a dropper that implements internet-blocking mechanisms via non-functional VPN connections. Once installed, the trojan abuses Accessibility Services and MediaProjection API to provide operators with near-complete device control, featuring VNC and hidden-screen control, UI-tree collection, keylogging, credential-stealing overlays, and screen-blocking capabilities. The malware appears designed as a Malware-as-a-Service offering, with a sophisticated control panel supporting multiple user roles and WebSocket-based C2 communications.
Indicators of Compromise
- hash: ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3
- hash: e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c
- ip: 45.147.28.59
Uncovering StreamRat: From Meta Ads to Full Device Takeover
Description
ThreatFabric researchers discovered StreamRat, a sophisticated Android banking trojan distributed through Meta and TikTok advertisements disguised as a free TV-streaming service targeting Spanish-speaking users. The campaign reached approximately 570,000 potential victims, primarily in Spain. StreamRat employs a two-stage installation process, utilizing a dropper that implements internet-blocking mechanisms via non-functional VPN connections. Once installed, the trojan abuses Accessibility Services and MediaProjection API to provide operators with near-complete device control, featuring VNC and hidden-screen control, UI-tree collection, keylogging, credential-stealing overlays, and screen-blocking capabilities. The malware appears designed as a Malware-as-a-Service offering, with a sophisticated control panel supporting multiple user roles and WebSocket-based C2 communications.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://www.threatfabric.com/blogs/from-meta-ads-to-full-device-takeover-uncovering-streamrat"]
- Adversary
- null
- Pulse Id
- 6a9826f869eb70a6b15298ec
- Threat Score
- null
Indicators of Compromise
Hash
| Value | Description | Copy |
|---|---|---|
hashba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3 | — | |
hashe0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c | — |
Ip
| Value | Description | Copy |
|---|---|---|
ip45.147.28.59 | — |
Threat ID: 6a984d43acd9273b4973cd82
Added to database: 09/02/2026, 16:22:27 UTC
Last updated: 09/02/2026, 23:46:33 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.