Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control

A malvertising campaign on Meta platforms targeted Spanish-speaking users with ads promoting a fake TV streaming app that delivers the StreamRat Android banking trojan. The malware, once installed, requests Accessibility and other permissions to enable remote device control, keystroke logging, and overlay attacks. The dropper first installs a non-functional VPN to disrupt analysis, then downloads and installs the final payload. The campaign ran from June 11 to July 3, 2026, and was also promoted via TikTok, though attribution remains unconfirmed.

AI-extracted · verify before operational use