The discovery of the StreamRat Android banking trojan being distributed through advertisements on Meta platforms highlights how rapidly malvertising is evolving from a nuisance into a direct malware-delivery channel. 

According to ThreatFabric, the campaign targeted Spanish-speaking users through advertisements promoting a fake television-streaming application. The campaign reportedly reached around 570,950 Meta accounts in the European Union, although the number of actual infections has not been disclosed.

What makes this campaign important is not simply the malware itself. It is the attack path.

Users increasingly assume that advertisements appearing on large platforms such as Facebook or Instagram have undergone some level of validation. Attackers are exploiting that assumption by purchasing legitimate advertising space and using it as the starting point of a malware infection chain.

The advertisement directs Android users to a specially prepared website that identifies the visitor's operating system and presents an APK download only to Android devices. The victim is then persuaded to sideload an application presented as a streaming service.

This is a good example of how modern malware campaigns avoid relying on a single vulnerability. Instead, attackers combine social engineering, application sideloading and abuse of legitimate Android functionality until they gradually obtain control over the device.

StreamRat does not immediately receive complete control after installation. The user is progressively encouraged to grant several powerful permissions.

The initial dropper attempts to become the device's default Home application, requests permission to establish a VPN connection, downloads another APK and asks for permission to install applications from unknown sources. The final StreamRat payload then requests Android Accessibility access.

Each individual request may appear explainable to a user who believes they are installing a streaming application. Collectively, however, these permissions create an extremely powerful attack environment.

Once Accessibility access is granted, StreamRat can inspect the user interface, capture keystrokes, display credential-stealing overlays and remotely interact with the device. This potentially gives the attacker visibility into banking applications, authentication workflows and other sensitive applications used on the phone.

Accessibility abuse continues to be one of the most important security problems in the Android malware ecosystem.

The feature exists for a legitimate and important reason: allowing applications to assist users who need accessibility support. But the same capability can give malware extensive visibility and interaction privileges.

For defenders, therefore, an application unexpectedly requesting Accessibility permission should be treated as a significant security event, especially when the application's stated purpose has little reason to require such access.

A streaming application asking for Accessibility control, permission to install additional applications, VPN configuration and screen-sharing capabilities should immediately raise suspicion.

One particularly interesting technique used by the StreamRat installer involves Android's VPN functionality.

Before installing the final malware, the dropper creates a VPN connection that routes traffic into a nonfunctional interface while excluding itself from the VPN. This temporarily prevents other applications from reaching the internet during the installation process.

ThreatFabric assesses that this behaviour may help interfere with some online reputation or analysis mechanisms. However, Google Play Protect can still perform offline detection for known malicious applications, so the technique does not completely eliminate Android's protection mechanisms.

The technique nevertheless demonstrates an important principle: security functionality built into an operating system can itself become part of an attack chain when users are socially engineered into granting the required permissions.

StreamRat also demonstrates how attackers continue to look for ways to observe the victim's screen.

The malware supports Android's MediaProjection API for screen capture, which normally generates a visible consent dialog and screen-sharing indication. Once Accessibility permission has already been granted, however, malware may be able to interact with these dialogs on behalf of the user.

StreamRat reportedly also uses Android's Accessibility screenshot functionality, providing an alternative way of capturing the screen without relying exclusively on MediaProjection.

For banking malware, the ability to see and interact with the screen is extremely valuable.

Instead of merely stealing stored credentials, an attacker may be able to observe authentication sessions as they occur and interact with applications remotely. This moves mobile malware increasingly toward an interactive remote-access model rather than traditional credential theft alone.

The advertising component of this incident also deserves attention.

Meta's advertising systems gave the attackers access to a very large potential audience. The reported campaign ran from June 11 to July 3, 2026 and was primarily focused on users in Spain. ThreatFabric also found evidence suggesting that the same infrastructure could identify traffic originating from TikTok, although public evidence of a specific TikTok advertising campaign was not provided.

This is not an isolated pattern.

Earlier in 2026, the Mirax Android RAT was also distributed through advertisements across Meta platforms, with malicious campaigns reaching hundreds of thousands of users. Mirax similarly relied on fake streaming services and ultimately provided attackers with remote-control capabilities over compromised Android devices.

The repeated use of fake streaming services is logical from an attacker's perspective. Users are accustomed to installing entertainment applications, and offers involving free television, movies or sports provide a strong incentive to bypass normal application-store restrictions.

The real warning sign therefore comes when an advertisement directs a mobile user away from an official application store and asks them to download an APK directly.

Enterprises should consider this attack pattern particularly important because mobile devices are now routinely used for corporate email, messaging, authentication and access to cloud applications.

A compromised personal or corporate Android device could potentially expose far more than banking credentials. Depending on the permissions obtained and applications installed, attackers may gain access to corporate credentials, authentication notifications, email sessions and internal communications.

Organizations using Android devices should therefore enforce restrictions on application sideloading wherever possible through mobile-device-management policies.

Security teams should also monitor for applications requesting unusual combinations of Accessibility, VPN, screen-capture and application-installation permissions.

Users should be trained to treat advertisements as untrusted content regardless of the platform hosting them. An advertisement being displayed by a major social network does not mean that the advertised software has been independently verified as safe.

The most useful defence remains surprisingly simple: applications promoted through advertisements should still be obtained through trusted application stores rather than downloaded as APK files from websites.

StreamRat ultimately demonstrates how attackers are combining several legitimate technologies to construct an effective malware-delivery chain.

The advertisement is legitimate advertising infrastructure.  The APK installation mechanism is legitimate Android functionality. Accessibility is a legitimate operating-system feature. VPN functionality is legitimate. MediaProjection is legitimate. None of these technologies is inherently malicious. The attack succeeds because the victim is persuaded to combine them in a way that gradually transfers control of the device to the attacker. That is increasingly what modern cyberattacks look like. Instead of breaking one security control, attackers convince users and systems to legitimately grant them the capabilities they need.

Cybersecurity researchers have disclosed details of a new Android banking trojan called StreamRat that was promoted to Spanish-speaking users through a fake television-streaming campaign on Meta and can give operators near-complete control of infected devices. ThreatFabric said the campaign's advertisement focused on Spain and reached an estimated 570,950 Meta accounts in the European Union

Source: Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control via The Hacker News — published 02 Sep 2026.