Do Son 
Image: ThreatFabric
At a Glance
- Malware family: StreamRat
- Threat actor: Suspected Spanish-speaking developer using Mirax infrastructure
- Target or victims: Spanish Android users (reached 570,000 Meta accounts)
- Delivery vector: Phishing sites linked from Meta and TikTok ads
- Key capabilities: VNC, hidden screen control, keylogging, and internet blocking
- Source: ThreatFabric
TL;DR
ThreatFabric researchers have uncovered the new StreamRat banking trojan. This malware targets Spanish Android users through fake television-streaming ads on social media. Ultimately, the StreamRat banking trojan campaign gives attackers near-complete control over infected devices.
Delivery
Threat actors launch the StreamRat banking trojan campaign using social media advertisements. Specifically, they purchase ads on Meta and TikTok that impersonate a free TV-streaming service named “Steamtv Esp”. One such ad campaign reached approximately 570,000 users between June 11 and July 3, 2026.
When a victim clicks the ad, they land on a malicious phishing website. First, the site uses JavaScript to check if the visitor is using an Android device. If it detects an iPhone or a desktop computer, it hides the download button. Next, the site checks which app the victim used to open the link. It then provides specific instructions to guide the user. These instructions show the victim how to allow app installations from unknown sources.
At the same time, the page script calls a backend API that sends a notification via Telegram. Interestingly, the distribution website operates on a dedicated control panel written in Spanish. This linguistic clue suggests the operator is likely Spanish-speaking. If the device passes all checks, the script instructs the browser to download a file named app.apk.
Infection Chain
Once the victim downloads the file, the StreamRat banking trojan begins its infection chain. The downloaded dropper resembles an older malware strain called Mirax. One notable aspect of the dropper is its interface structure. It consists of several interconnected HTML pages containing embedded JavaScript. Each page loads at a specific stage of the infection process.
After the victim launches the app, the dropper asks to become the default Home application. This ensures the victim returns to the dropper interface whenever they press the Home button. Then, the dropper uses a clever anti-detection technique. It requests permission to establish a virtual private network connection. If granted, it routes all device traffic into a dead end, while excluding itself from the block. This temporarily cuts off internet access for other apps. As a result, it prevents security tools from performing cloud-based reputation checks during the installation.
After securing the environment, the main page triggers the payload download from a GitHub repository. ThreatFabric notes that this repository belongs to the same user who previously distributed the Mirax trojan. In addition, the threat actor has used GodFather financial malware in the past. The dropper saves the payload file in the public Downloads folder. Then, it installs the payload using the Android package installation mechanism. Finally, the dropper disables the VPN so the malware can communicate with its server.
Command-and-Control and Data-Exfiltration Behaviour
Upon execution, the StreamRat banking trojan requests access to Android Accessibility Services. After gaining permission, it connects to its command-and-control server using a WebSocket connection. At the beginning of the communication flow, the bot sends a GET request to upgrade the connection. The custom headers include a unique device identifier, the device model, and the Android API level. The custom protocol supports both plain-text and binary-text formats. The malware immediately collects a list of all installed applications and sends it in chunks.
The malware provides operators with two modes for screen streaming. The first mode uses the MediaProjection API for standard screen casting. The second mode uses the Accessibility API to take hidden screenshots every 200 milliseconds. To save bandwidth, the malware aggressively compresses the images. It also calculates checksums to avoid sending duplicate frames.
In addition to screen streaming, the StreamRat banking trojan campaign utilizes an Accessibility Node Viewer. This feature acts as a text-based form of screen casting. Instead of sending images, the malware reconstructs the screen using individual interface elements. It dumps the complete user interface tree, serializes it into a JSON object, and sends it to the server.
Furthermore, the trojan captures data typed by the victim. It monitors the active foreground application. When the user opens a targeted app, the malware can display credential-stealing overlays. The malware supports both automatic and immediate overlays. Automatic overlays trigger when the victim opens specific non-system applications. The bot downloads an HTML file and launches a dedicated web view to display a fake login screen. A JavaScript interface passes the stolen credentials back to the Android component.
Meanwhile, immediate overlays distract the victim. For example, the fake update overlay shows a progress bar and warns the user not to turn off the device. This deception allows the attacker to operate freely in the background.
In a recent report detailing the StreamRat banking trojan campaign, researchers confirmed the geographical focus. ThreatFabric states, “The vast majority of observed victims were located in Spain”. The researchers also believe the malware operates under a Malware-as-a-Service model.
Defense or Detection Guidance
Users must remain cautious of social media advertisements that promote free streaming apps. Do not install applications from unknown sources. Always verify the legitimacy of a service before downloading its software.
Furthermore, users should deny unexpected requests for Accessibility Services or VPN access. A simple streaming app does not need these permissions to function. If an application asks to become the default launcher, users should uninstall it immediately. Security teams should monitor devices for apps that request both package-installation capabilities and VPN functionality. ThreatFabric concludes that this combination “should be treated as a notable risk signal and deserves closer scrutiny”.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
