Meta Ads Push Stream Rat Android Trojan That Can Gain Near-Complete Device Control
Summary: ThreatFabric disclosed a new Android banking trojan called StreamRat, promoted through a fake television-streaming ad campaign on Meta that focused on Spain and reached an estimated 570,950 Meta accounts in the European Union at least once. After the victim sideloads an APK, the dropper requests default Home status, VPN permission, and unknown-source install rights before delivering the payload, which then asks for Accessibility access to capture keystrokes, show credential-stealing overlays, inspect the visible interface, and control the device remotely.
Key Takeaway: The chain only completes if the user grants a succession of permissions unrelated to streaming, and once Accessibility is enabled the operators hold near-complete control of the device. ThreatFabric did not attribute the campaign to a named threat actor, and totals for infected devices and confirmed victims remain unreported.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026