Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control

Summary

A new Android banking trojan, StreamRat, was distributed via Meta ads targeting Spanish speakers. It can gain near-complete device control by tricking users into granting extensive permissions. Researchers at ThreatFabric identified the campaign, which ran from June to July 2026.

Key Takeaways

1. A new Android banking trojan called StreamRat was promoted to Spanish-speaking users through a fake television-streaming campaign on Meta.
2. StreamRat can give operators near-complete control of infected devices by requiring users to grant a succession of controls after sideloading the Android Package (APK).
3. The campaign's advertisement focused on Spain and reached an estimated 570,950 Meta accounts in the European Union.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article presents technical details and analysis from a cybersecurity firm, ThreatFabric. It cites specific indicators of compromise and campaign timelines. While it lacks direct quotes from victims or law enforcement, the information is presented factually and attributed to a credible source in the cybersecurity field.

Bias assessment: Technical Security Reporting. The article focuses on the technical aspects of a malware campaign, detailing its methods and origins. The language is objective and informative, aiming to educate readers about a cybersecurity threat rather than promote a specific agenda.

Note: This article provides a technical analysis of a cybersecurity threat. While factual, it may require some technical understanding to fully grasp the implications.

Credibility flag: Informative, Technical

Claimed Facts (6)

• This is a factual statement reporting the discovery and capabilities of the malware.
• This provides specific data and attribution from a cybersecurity firm regarding the campaign's reach.
• This statement provides a clear timeline of events related to the malware campaign.
• This statement connects the current malware to previous threats, providing a factual link.
• This is a specific technical identifier (hash) for a malicious file.
• This is a specific technical identifier (IP address) for a command and control server.

Opinions (4)

• This is an assessment and interpretation of the malware's nature and origin, presented as a conclusion by ThreatFabric.
• This is advice or a recommendation to users, based on the analysis of the threat.
• The use of 'likely' indicates an inference or educated guess rather than a confirmed fact.
• This statement offers an interpretation of the malware's applicability based on observed behavior and lack of specific data.

Claims (5)

• While this describes a function, the implication of 'returning the victim to its interface' could be framed to sound more manipulative than a standard app permission.
• This statement describes a technical process that, while potentially true, could be interpreted as an alarmist description of a temporary disruption.
• The word 'may' indicates a speculative outcome, making this claim less certain and potentially an overstatement of impact.
• This describes a capability that, while technically accurate, can sound alarming due to the broad implications of 'interacting with consent dialogs'.
• This describes a stealthy capability that, while factual, can be presented in a way that emphasizes the deceptive nature of the malware.

Key Sources

• ThreatFabric — Cybersecurity Research Firm