A newly identified Android banking trojan named StreamRAT is giving attackers full remote control over infected phones. The malware blends traditional banking fraud with remote device control via VNC (Virtual Network Computing) screensharing and abuse of Android’s Accessibility services to trick users into surrendering sensitive information and credentials.
What StreamRAT Does
StreamRAT activates after a multi-stage infection process. First, users—mainly Spanish-speaking—are lured through ads on social media platforms like Meta and TikTok into installing an APK from unofficial sources. Once installed, the malware prompts victims to enable Android’s Accessibility Services, which in benign uses helps with tasks like reading screen content or performing actions for users who need assistance. In StreamRAT’s case, those permissions allow attackers to simulate taps, swipes, and essentially take control of navigation on the device.
The malware offers two screen-viewing options. One uses Android’s built-in screen-capture system via VNC; the other—called hidden VNC—captures repeated screenshots via Accessibility without raising the usual indicators. Beyond simply watching, the attackers can rebuild screens as interface text, intercept keystrokes, list installed apps, deploy fake login forms that mimic legitimate apps, and gather unlock credentials.
Delivery, Deception & Evasion
Infection starts with social media ads promoting free streaming services. A phishing site serves up fake setup instructions tailored to Android users, steering them to install the initial ‘dropper’ and push them to grant Accessibility and permission to install unknown apps. The dropper then may try to become the default home screen app—trapping victims inside its interface. After that, it installs the final malware payload.
StreamRAT also deploys more cunning evasion tricks: It can break internet connectivity by disabling parts of a VPN—except for itself—to avoid reputation checks or cloud-based detection while still accessing the network. Communication with attacker servers is handled through WebSocket connections. Rather than continuously sending redundant screen data, it optimizes transmission by skipping duplicates—an efficiency that suggests the operators intend to run this framework at scale.
Indicators & Prevention Tips
Existing signatures tied to StreamRAT include specific app package names, misleading app titles, and SHA-256 hashes, as well as command-and-control (C2) IP addresses. Some of the app names observed include “StrεamTV Pro” and “Sistema de vídeo.” Packages like io.base.one887 and io.meat.hint are flagged in connection with these apps. The IPs 45.147.28[.]59 and 193.32.2[.]245 are associated with its C2 infrastructure.
For users, avoiding APKs from ads or untrusted sources is key. Always decline unexpected requests to enable Accessibility, install unknown apps, or change VPN settings. Immediately remove unfamiliar apps—especially those that ask to be default launchers. For organizations, Mobile Device Management tools should monitor for unusual defaults, suspicious screen-capture or Accessibility use, and app installations outside official stores. Security operations centers should treat the listed hashes, package names, C2 IPs and domains as alarms—not definitive proof but strong leads.
StreamRAT stands out for merging real-time spying, interface manipulation, and credential theft into a single toolset. Rather than just stealing banking details, it can effectively hijack a device. That makes it a worrisome evolution in mobile banking malware.
What this means and what to watch: StreamRAT signals a growing trend toward malware-as-a-service deployment in Android threats, combining social engineering, remote control, and deceptive overlays to evade detection. As these campaigns scale, security defenses—both for individuals and organizations—must treat requests for Accessibility access and unknown-sourced installations with exceptional skepticism. Emerging tools and detection strategies focused on UI behavior, permission abuses, and unusual screen capture requests deserve high priority in threat monitoring.
