StreamRat Android Banking Trojan Spread via Meta Ads — Detection and Remediation Guide

What Happened

ThreatFabric has disclosed a new Android banking trojan dubbed StreamRat that was distributed through a coordinated malvertising campaign on Meta's advertising platform. The campaign used fake television-streaming lures — a familiar social engineering hook — aimed squarely at Spanish-speaking users, with the advertisement focus on Spain. According to ThreatFabric's analysis, the campaign reached an estimated 570,950 Meta accounts in the European Union.

This is not a nuisance adware family. StreamRat is a full-featured banking trojan that, once installed, gives its operators near-complete control of the infected device: screen streaming, overlay attacks against banking apps, SMS interception (which defeats SMS-based 2FA), keystroke capture, and remote command execution. For organizations, the risk extends beyond the individual victim — a compromised personal device that also holds corporate email, MFA authenticator apps, or SSO sessions is a live intrusion vector into your environment.

Defenders need to act on two fronts simultaneously: (1) hunt for evidence that users in your environment downloaded or sideloaded the malicious APK, and (2) close the policy and technical gaps that allowed an untrusted Android package onto devices touching corporate resources in the first place.

Technical Analysis

Delivery Vector: Malvertising at Scale

The most significant aspect of this campaign is the distribution mechanism. StreamRat was not spread through sketchy third-party app stores or SMS phishing alone — it was promoted through Meta's paid advertising infrastructure, which gave the operators legitimacy-by-association, precise demographic targeting (Spanish-speaking users, Spain-focused), and enormous reach (570,950 accounts in the EU alone).

The lure was a fake television/streaming application. Victims who clicked the ad were funneled to a download of a malicious APK outside of Google Play's review pipeline. This pattern — paid ads on a mainstream platform redirecting to sideloaded APKs — bypasses the single most effective Android malware control (Play Store-only installs) by convincing the user to bypass it.

Capabilities

Based on ThreatFabric's reporting, StreamRat's feature set places it in the same operational tier as established Android banking malware families:

• Remote device control (VNC-style streaming): Operators can view and interact with the device screen in real time, enabling manual fraud that defeats most automated anomaly detection on the banking side.
• Accessibility Services abuse: Like nearly every modern Android banking trojan, StreamRat almost certainly leverages Android Accessibility Services to grant itself additional permissions, read screen content, perform gestures, and block uninstallation. Accessibility abuse is the linchpin of Android RAT functionality.
• Overlay/injection attacks: Fake login screens drawn over legitimate banking applications to harvest credentials.
• SMS interception: Capture of one-time passwords and transaction authorization codes, neutralizing SMS-based MFA.
• Credential and data theft: Exfiltration of banking credentials and other sensitive on-device data to operator infrastructure.

Affected Platforms

• Platform: Android devices (all versions where the user permits installation from unknown sources and grants Accessibility access)
• Target population: Spanish-speaking users; ad targeting focused on Spain; ~570,950 Meta accounts in the EU reached
• No CVE is associated with this campaign. StreamRat does not exploit a software vulnerability — it exploits user trust and the sideloading/Accessibility permission model. Do not wait for a patch; there is none coming. Defense is behavioral, architectural, and policy-based.

Exploitation Status

This is confirmed, active, in-the-wild distribution — not a proof of concept. The campaign ran on live Meta ad infrastructure and reached over half a million accounts. Treat this as an active threat requiring immediate hunting, not a theoretical exercise.

Detection & Response

Because StreamRat lives on Android endpoints, most traditional Windows-centric telemetry won't see the malware itself. Your detection surface is: (a) corporate workstations and managed devices where APK artifacts may transit (downloads, MDM sync folders, email attachments), (b) network/proxy telemetry for APK downloads outside sanctioned stores, and (c) mobile threat defense / MDM compliance signals. The rules and queries below focus on those observable points.

Sigma Rules

---
title: APK File Downloaded Outside Corporate Mobile Development Paths
id: 8f2b4c11-3d7a-4e9f-b6c2-1a5d9e7f3c84
status: experimental
description: Detects Android APK package files being written to endpoints outside of legitimate mobile development or MDM staging directories. APKs on workstations with no business justification are a strong indicator of sideload staging or malware transit.
references:
  - https://thehackernews.com/2026/09/meta-ads-push-streamrat-android-trojan.html
  - https://attack.mitre.org/techniques/T1424/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.initial_access
  - attack.t1424
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '.apk'
  filter_legitimate_dev:
    TargetFilename|contains:
      - '\AndroidStudioProjects\'
      - '\AppData\Local\Android\'
      - '\MDM\'
      - '\Intune\'
      - '\gradle\'
  condition: selection and not filter_legitimate_dev
falsepositives:
  - Mobile developers building and testing APKs
  - MDM administrators staging legitimate enterprise applications
level: medium
---
title: ADB Sideloading of Android Packages
id: 2c9e7a45-6b1f-4d38-a952-7f4c8b2e1d63
status: experimental
description: Detects use of Android Debug Bridge (adb.exe) to install APK packages from a workstation onto an Android device. Outside of development and mobile security teams, adb install activity is a high-fidelity indicator of unauthorized sideloading.
references:
  - https://thehackernews.com/2026/09/meta-ads-push-streamrat-android-trojan.html
  - https://attack.mitre.org/techniques/T1476/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1476
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\adb.exe'
    CommandLine|contains:
      - 'install'
  filter_pm:
    CommandLine|contains: 'install-multiple'
  condition: selection
falsepositives:
  - Mobile application developers and QA engineers
  - Mobile security research teams
level: high
---
title: HTTP Download of APK From Non-Google Infrastructure
id: 5d3a9f27-8c4e-4b61-b837-9e2d6a1f4c75
status: experimental
description: Detects HTTP/S requests retrieving Android APK files from hosts that are not Google Play or sanctioned MDM/app store infrastructure. Sideloaded APK delivery — the StreamRat distribution method — is directly observable in proxy and firewall logs.
references:
  - https://thehackernews.com/2026/09/meta-ads-push-streamrat-android-trojan.html
  - https://attack.mitre.org/techniques/T1189/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.initial_access
  - attack.t1189
logsource:
  category: proxy
detection:
  selection:
    cs-uri|endswith: '.apk'
  filter_trusted:
    r-dns|contains:
      - 'googleapis.com'
      - 'google.com'
      - 'gvt1.com'
      - 'gvt2.com'
      - 'microsoft.com'
      - 'samsungapps.com'
  condition: selection and not filter_trusted
falsepositives:
  - Enterprise MDM-hosted APK distribution
  - Legitimate vendor APK distribution (some OEMs and regional app stores)
level: high

KQL — Microsoft Sentinel / Defender

The following hunt looks across file, network, and email telemetry for APK artifacts entering your environment. Run it over the last 30 days initially, then wire it into a scheduled analytics rule.

let Lookback = 30d;
let TrustedApkHosts = dynamic(["googleapis.com","play.google.com","gvt1.com","gvt2.com","microsoft.com","samsungapps.com"]);
// Stage 1: APK files created on endpoints (downloads, email saves, sync folders)
let EndpointApks = DeviceFileEvents
| where TimeGenerated > ago(Lookback)
| where FileName endswith ".apk"
| where FolderPath !has_any ("AndroidStudioProjects", "gradle", "Intune")
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName;
// Stage 2: Network retrieval of APKs from non-trusted hosts (proxy/firewall via CEF or Syslog ingestion)
let NetworkApks = CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where RequestURL endswith ".apk" or FileType =~ "apk"
| where DestinationHostName !has_any (TrustedApkHosts)
| project TimeGenerated, SourceIP, DestinationHostName, RequestURL, DeviceAction;
// Stage 3: Correlate and surface
union EndpointApks, NetworkApks
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, FileName, SHA256, DestinationHostName, RequestURL
| sort by LastSeen desc

For organizations ingesting Microsoft Defender for Endpoint URL telemetry, add this second query to catch the ad-to-redirect chain — users clicking Meta ads that resolve to APK downloads:

DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl endswith ".apk"
| where RemoteUrl !has_any ("googleapis.com","play.google.com","gvt1.com","gvt2.com","microsoft.com")
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessAccountName
| sort by TimeGenerated desc

Velociraptor VQL

Use this hunt artifact across your Windows fleet to identify APK artifacts staged on endpoints — in Downloads folders, browser caches, or email client attachment stores — along with any active adb processes that could indicate sideloading in progress.

-- Hunt: StreamRat-style APK staging and sideload tooling on Windows endpoints
LET apk_artifacts = SELECT
    FullPath,
    Size,
    Mtime,
    hash(path=FullPath) AS Hash
FROM glob(globs=[
    'C:/Users/*/Downloads/*.apk',
    'C:/Users/*/Desktop/*.apk',
    'C:/Users/*/Documents/*.apk',
    'C:/Users/*/AppData/Local/Microsoft/Outlook/*.apk',
    'C:/Users/*/AppData/Local/Temp/*.apk'
])
WHERE Mtime > now() - 2592000

LET adb_procs = SELECT
    Pid,
    Name,
    CommandLine,
    Exe,
    Username
FROM pslist()
WHERE Name =~ '(?i)adb'
   AND CommandLine =~ '(?i)install|push|sideload'

SELECT * FROM apk_artifacts
UNION ALL
SELECT
    Exe AS FullPath,
    Pid AS Size,
    NULL AS Mtime,
    CommandLine AS Hash
FROM adb_procs

Remediation Script

This PowerShell script audits endpoints for APK artifacts, checks them against Microsoft Defender, and reports suspicious adb tooling. Run it via your RMM/Intune across the fleet; pipe results to your SIEM.

# StreamRat APK Staging Audit — Security Arsenal IR Script
# Scans user profiles for APK files, hashes them, and triggers Defender scans

$ReportPath = "$env:ProgramData\StreamRat_Audit_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
$SearchPaths = @(
    "$env:SystemDrive\Users\*\Downloads",
    "$env:SystemDrive\Users\*\Desktop",
    "$env:SystemDrive\Users\*\Documents",
    "$env:SystemDrive\Users\*\AppData\Local\Temp"
)

$Findings = @()
foreach ($Path in $SearchPaths) {
    Get-ChildItem -Path $Path -Filter "*.apk" -Recurse -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-90) } |
    ForEach-Object {
        $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        # Submit path to Defender for on-demand scan
        Start-MpScan -ScanPath $_.FullName -ScanType CustomScan -ErrorAction SilentlyContinue
        $Findings += [PSCustomObject]@{
            Hostname      = $env:COMPUTERNAME
            FilePath      = $_.FullName
            SHA256        = $Hash
            SizeBytes     = $_.Length
            LastWriteTime = $_.LastWriteTime
        }
    }
}

# Check for adb tooling presence (unauthorized sideload capability)
$AdbPaths = Get-ChildItem -Path "$env:SystemDrive\Users\*" -Filter "adb.exe" -Recurse -Depth 4 -ErrorAction SilentlyContinue
foreach ($Adb in $AdbPaths) {
    $Findings += [PSCustomObject]@{
        Hostname      = $env:COMPUTERNAME
        FilePath      = "ADB_TOOLING: $($Adb.FullName)"
        SHA256        = "N/A"
        SizeBytes     = $Adb.Length
        LastWriteTime = $Adb.LastWriteTime
    }
}

if ($Findings.Count -gt 0) {
    $Findings | Export-Csv -Path $ReportPath -NoTypeInformation
    Write-Output "[ALERT] $($Findings.Count) APK/ADB artifacts found. Report: $ReportPath"
} else {
    Write-Output "[CLEAN] No APK artifacts or adb tooling detected."
}

Remediation

There is no vendor patch for StreamRat — it exploits user behavior and Android's sideloading/Accessibility permission model, not a software flaw. Remediation is therefore architectural and policy-driven. Execute the following in priority order:

1. Contain and remediate infected devices immediately.

• Any Android device confirmed infected must be treated as fully compromised: the operator had near-complete control, which means every credential, session token, and MFA secret on that device is burned.
• Isolate the device from corporate networks (revoke VPN, conditional access, and Wi-Fi access via MDM).
• Factory reset is mandatory — do not attempt selective cleanup of a RAT with Accessibility persistence.
• Force password resets for all accounts accessed from the device, revoke OAuth grants and refresh tokens, and re-enroll MFA on a clean device.

2. Block the distribution vector.

• Via MDM (Intune, Workspace ONE, etc.), enforce block installation from unknown sources on all corporate and BYOD-enrolled Android devices. On fully managed devices, restrict installs to the managed Google Play profile only.
• Deploy a mobile threat defense (MTD) solution — Microsoft Defender for Endpoint on Android, Lookout, or Zimperium — and enforce conditional access so non-compliant devices cannot reach corporate resources.
• Add Meta ad-serving click-through domains observed delivering APKs to your web proxy blocklist; alert on any .apk retrieval from non-sanctioned hosts (see Sigma rule three above).

3. Harden authentication against SMS theft.

• StreamRat intercepts SMS, which means SMS-based OTP provides zero assurance on an infected device. Migrate banking-adjacent and corporate authentication to phishing-resistant methods (FIDO2/passkeys) or at minimum authenticator-app-based TOTP — noting that on-device authenticator apps are also at risk on a compromised device, which is why device compliance must gate access.

4. User awareness — targeted, not generic.

• Brief Spanish-speaking user populations specifically: streaming-service ads on Facebook/Instagram offering "free TV" apps that require installing an APK are a live malware delivery channel right now.
• Reinforce one durable rule: legitimate streaming services are installed from Google Play, never from an ad redirect. Any app that then requests Accessibility access should be treated as hostile.

5. Pressure the platform layer.

• Report the malicious ad campaign to Meta through their ad-reporting flow and file abuse reports with the hosting infrastructure serving the APK (pull indicators from ThreatFabric's published research).
• Financial-sector organizations should share indicators with FS-ISAC and relevant national CERTs (Spain's INCIBE is directly relevant given the targeting).

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub