Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control
StreamRat is a sophisticated Android banking trojan promoted via fake TV-streaming ads on Meta, reaching an estimated 570,950 EU accounts targeting Spanish-speaking users The malware achieves near-complete device control through a multi-stage infection chain involving a dropper, VPN hijacking, and Accessibility service exploitation The campaign leveraged social engineering through fake streaming apps (StrεamTV Pro, Sistema de vídeo) distributed via sideloading, with promotion also detected on Ti
Analysis
TL;DR
- StreamRat is a sophisticated Android banking trojan promoted via fake TV-streaming ads on Meta, reaching an estimated 570,950 EU accounts targeting Spanish-speaking users
- The malware achieves near-complete device control through a multi-stage infection chain involving a dropper, VPN hijacking, and Accessibility service exploitation
- The campaign leveraged social engineering through fake streaming apps (StrεamTV Pro, Sistema de vídeo) distributed via sideloading, with promotion also detected on TikTok
- The dropper temporarily disables internet connectivity via a non-functional VPN to evade online reputation checks and Google Play Protect detection during payload installation
- ThreatFabric linked the StreamRat payload infrastructure to a GitHub account associated with the earlier Mirax campaign, suggesting shared threat actor resources
Why It Matters
This incident demonstrates how threat actors are increasingly weaponizing legitimate advertising platforms like Meta to distribute sophisticated Android malware at scale, targeting specific linguistic demographics with culturally tailored lures. The technical sophistication of StreamRat — particularly its use of VPN disruption to evade detection and dual-mode screen capture capabilities — highlights an evolving threat landscape where malware authors are adopting advanced evasion techniques previously uncommon in Android banking trojans.
Technical Details
- Infection Chain: Meta ad → specially crafted landing page (OS detection for Android) → app.apk dropper → VPN permission request → payload download as update_{timestamp}.apk → unknown sources permission → StreamRat installation → Accessibility access grant → C2 connection
- VPN Evasion Technique: The dropper establishes a VPN connection that routes all traffic to a nonfunctional interface while excluding itself, effectively cutting off internet connectivity for other apps during the critical installation window to reduce online reputation checks and detection risk
- Screen Capture Capabilities: StreamRat employs two screen capture methods — MediaProjection API (visible indicator, consent dialog) and Accessibility takeScreenshot() method (stealth mode without indicator), with the latter enabled after Accessibility permissions are granted
- Post-Accessibility Privileges: Once Accessibility access is obtained, operators can capture keystrokes, display credential-stealing overlays, inspect the visible interface, and control the device remotely
- Indicators of Compromise: SHA-256 hashes (e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c, ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3), packages (io.base.one887, io.meat.hint), applications (StrεamTV Pro, Sistema de vídeo), and C2 IPs (45.147.28.59, 193.32.2.245)
Industry Insight
- Security teams should implement mobile threat detection policies that flag unusual permission request sequences, particularly VPN + Accessibility combinations from sideloaded apps, and educate users to scrutinize permission dialogs unrelated to the app's stated purpose
- Advertising platforms and mobile OS vendors should strengthen pre-publishing security checks for APKs distributed through landing pages promoted via their ad networks, as the Meta campaign's reach of 570,950+ accounts demonstrates the scale of platform-based malware distribution
- The link between StreamRat and the Mirax campaign via shared GitHub infrastructure suggests threat actors are maintaining reusable dropper frameworks with daily updates — organizations should monitor for similar infrastructure patterns and share IoCs across the security community to detect related campaigns early
Disclaimer: The above content is generated by AI and is for reference only.