StreamRAT Abuses Android Accessibility, MediaProjection and HVNC for Full Device Takeover

Gbhackers •Mayura Kathir • September 3, 2026

StreamRAT, a newly identified Android banking trojan distributed through fake free-TV streaming advertisements on Meta and TikTok. The campaign, tracked as “Steamtv Esp.,” primarily targeted Spanish-speaking Android users and exposed an estimated 570,000 Meta users between June 11 and July 3, 2026. The operation highlights the continued effectiveness of piracy-themed social engineering. Victims who clicked […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

StreamRat Trojan Targets Spanish Users via Meta Ads In late July 2026, a new Android banking trojan named StreamRat was identified, targeting Spanish-speaking users through a fake television-streaming campaign on Meta platforms. The malware is distributed via a phishing website that checks the user's operating system before allowing the download of a malicious APK file. Once installed, StreamRat can gain extensive control over the infected device, including keystroke logging and remote access. The campaign reached approximately 570,000 users, primarily in Spain. StreamRat is believed to be developed as a Malware-as-a-Service (MaaS) offering, utilizing advanced techniques such as an Internet-blocking mechanism during installation. ThreatFabric has not attributed the campaign to any specific threat actor. The malware can also be propagated through TikTok, further expanding its reach. 4 sources 70

StreamRAT Abuses Android Accessibility, MediaProjection and HVNC for Full Device Takeover

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Malware (2)

Platforms (2)