Cybersecurity researchers have uncovered a malicious campaign called StreamRat, in which Android users are tricked into installing what appears to be a free streaming app—but is actually a remote-control trojan. The scheme, first identified in June 2026, relies on social media ads targeting Spanish-speaking users in Spain. These ads, seen by roughly 570,000 people between June 11 and July 3, promise free television access, but they deliver something far more dangerous.
The attackers use tailored websites linked from the ads to detect whether a visitor is on an Android device. If so, the sites guide the user in installing software from outside official app stores and enable powerful permissions via Android’s Accessibility settings. These permissions allow StreamRat to monitor screen content, record keystrokes, simulate taps and swipes, and overlay fake login screens.
How the Infection Works
The infection begins with a “dropper” app that requests to be set as the device’s default home screen. Once home is pressed, the device returns to instructions from the dropper, rather than the legitimate home screen. Meanwhile, this app quietly downloads the main StreamRat payload. After the user grants it Accessibility privileges, the malware gains sweeping control—this includes harvesting credentials, observing open apps, and enabling remote interaction. Either through Android’s official screen-sharing framework or by capturing successive screenshots, the operator can both view the screen and control it without any visible indicator.
Stealth Tactics & Risks
To hide its tracks, StreamRat can display a black screen or mimic a system update while its operators continue using the device in the background. Fake login pages are shown to capture account credentials. It also requests VPN permissions and temporarily cuts off other apps’ internet access, presumably to evade cloud-based defenses during installation. Researchers spotted signs of this behavior in multiple samples.
Researchers also discovered infrastructure suggesting the malware is managed by a multi-operator setup. There are control panels with role-based access and tools to build malicious builds. But while the reach of the ad campaign is large, there is no verified count of how many devices are infected or how many users actually fell victim.
To spot StreamRat infections, analysts published Indicators of Compromise, including SHA-256 hashes, package names like io.base.one887and io.meat.hint, and app names such as “StrεαmTV Pro” and “Sistema de vídeo.” They also identified command-and-control servers and malicious file paths used in the infection chain.
Best practices to avoid this type of malware include skipping app installs promoted via social ads or unfamiliar sites, especially if they ask for Accessibility rights, screen capture permissions, or VPN setup. Organizations should monitor for unusual permission changes, default home screen swaps, and sideloaded installations.
StreamRat adds to a growing trend of Android banking trojans and remote-control malware using fake streaming services as bait. It represents a heightened threat because of its multifaceted abuse of permissions and stealth features. Users should be cautious, and security teams should be on alert for signs of compromise.
