THREATFABRIC researchers have identified a new Android banking trojan named StreamRat, with the vast majority of observed victims located in Spain. The campaign was conducted via social media ads on Meta and TikTok, impersonating a free TV‑streaming service called “Steamtv Esp”. Between 11 June and 3 July 2026, the operators reached around 570,000 users.
The phishing sites use device checks to target Android users and to deter other platforms, then instruct potential victims to enable installations from unknown sources. A backend control panel in Spanish confirms the operator’s likely Spanish‑speaking origin.
Infection begins when a user downloads a dropper that mimics Mirax and presents a multi‑page HTML/JavaScript interface. The dropper persuades the user to set it as the default Home app and attempts to enable a VPN to divert traffic, momentarily hindering other apps from cloud‑based reputation checks. The payload is downloaded from a GitHub repository and installed via the Android package mechanism, after which the dropper disables the VPN.
Once active, StreamRat uses Android Accessibility Services to contact its C2 via WebSocket, sending device and app data and enabling two screen‑streaming modes: standard via MediaProjection and hidden captures via the Accessibility API. It can render overlays for credential theft and uses a text‑based “Accessibility Node Viewer” to reconstruct the screen as JSON.
Researchers note the banking trojan can monitor foreground apps and deliver both automatic and immediate overlays, including fake update prompts, to keep users compromised while the attacker operates in the background. The campaign is framed as Malware‑as‑a‑Service.