Reported by 2 outlets
StreamRAT Android Malware Targets 570K Meta Users in Spain
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.56 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
StreamRAT Android Malware Abuses Accessibility and VNC to Take Full Control of Devices
cyberpress.org · 40d ago · September 3rd, 2026
One campaign, called “Steamtv Esp,” potentially reached around 570,000 Meta users between June 11 and July 3, 2026, with Spain appearing to be the main target. The campaign uses TV-streaming lures similar to earlier IPTV-themed malware campaigns. Victims who click an ad are taken to a phishing website that checks whether they are using Android. Non-Android visitors cannot access the download button. Android users are guided through steps to allow app installation from unknown sources and enable Accessibility Services. The malicious APK , disguised as a streaming application such as “StrεαmTV Pro,” is then downloaded and installed. ThreatFabric said the payload was hosted on a GitHub repository linked to an operator that previously distributed the Mirax Android trojan. The actor has also used GodFather malware, suggesting continued activity in Android financial fraud operations. StreamRAT Seizes Android Devices StreamRAT is deployed through a dropper that uses HTML pages and embedded JavaScript to guide the victim through installation. The dropper can ask to become the device’s default launcher, allowing it to regain control whenever the user presses the Home button. StreamRAT Seizes Android Devices (Source: threatfabric) A notable feature is its use of a non-functional VPN connection . Before downloading the final payload, the dropper requests VPN permission and routes most device traffic through a connection that does not forward data. The malware itself is excluded from the
-
update from gbhackers.com
StreamRAT Abuses Android Accessibility, MediaProjection and HVNC for Full Device Takeover
gbhackers.com · 40d ago · September 3rd, 2026
StreamRAT, a newly identified Android banking trojan distributed through fake free-TV streaming advertisements on Meta and TikTok. The campaign, tracked as “Steamtv Esp.,” primarily targeted Spanish-speaking Android users and exposed an estimated 570,000 Meta users between June 11 and July 3, 2026. The operation highlights the continued effectiveness of piracy-themed social engineering. Victims who clicked […] The post StreamRAT Abuses Android Accessibility, MediaProjection and HVNC for Full Device Takeover appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .