Malware News This Facebook, Instagram, TikTok free streaming app ad leads to "full device takeover"

[Brownie2019]

Content source

https://www.neowin.net/news/this-facebook-instagram-tiktok-free-streaming-app-ad-leads-to-full-device-takeover/

Social media ads disguised as free streaming services spread StreamRat, enabling attackers to remotely control Android devices.
Cybercriminals are increasingly turning to social media advertising to distribute malware, and a new Android banking trojan shows just how dangerous these campaigns can become. Security researchers have uncovered StreamRat, a previously unknown piece of Android malware that was promoted through Meta and TikTok ads disguised as a free TV streaming service.

According to ThreatFabric, which uncovered the campaign, these malicious ads primarily targeted users in Spain, with one Meta advertising campaign reaching approximately 570,000 users between June 11 and July 3, 2026. The researchers discovered the campaign while monitoring streaming-themed lures and found that victims were eventually directed toward a malicious APK capable of giving attackers extensive control over an infected Android device.

The attack begins with adverts promoting what appears to be a free streaming service. Once a user clicks that ad, they are taken to a specially designed website that checks whether the visitor is using Android. Users on other operating systems are simply shown an error, while Android users are presented with a download option.

The website then determines whether the victim opened it through Facebook, Instagram, TikTok, or a regular browser and displays instructions accordingly. These instructions misleadingly convince the victim to allow installations from unknown sources and grant the malware access to Android's Accessibility Services.

The downloaded APK acts as a dropper to help deliver than the final malware. It can even ask the victim to make it the device's default launcher, meaning pressing the Home button sends the user back to its interface. The dropper then downloads the actual StreamRat payload, installs it and launches it before eventually removing itself as the default launcher.

An interesting part of the infection chain is that the dropper creates a deliberate, non-functional VPN connection. If you are wondering why, this is done to effectively cut other apps off from the internet while the dropper itself can continue operating. ThreatFabric believes this is designed to make it harder for security products to perform cloud-based checks on the newly installed malware. Google Play Protect could be one of those, although the researchers point out that the technique does not completely bypass Play Protect because it also has offline detection capabilities.

Once StreamRat is running and has obtained Accessibility Services access, things get considerably more serious. The malware connects to its command-and-control (C2) server, collects information about installed applications and continuously monitors what is displayed on the screen. It can also capture data entered by the victim.

The trojan supports two different forms of remote screen access. Its VNC ( (Virtual Network Computing) mode uses Android's MediaProjection API to capture the screen, while its hidden VNC (HVNC) mode uses the Accessibility API to take screenshots without displaying the usual screen-sharing indicator. The latter can capture a screenshot every 200 milliseconds, giving an attacker a near-real-time view of the device without the victim even suspecting anything.

StreamRat can go even further with its Accessibility Node Viewer. ThreatFabric describes this as a text-based form of screen casting, where the malware reconstructs what is displayed using individual AccessibilityNodeInfo elements instead of sending a bitmap of the screen. The firm remarks it's "one of the fastest ways to collect, transmit, and visualize what is currently displayed on the victim’s device."

The malware also supports overlay attacks, which could be greatly useful for stealing banking credentials. StreamRat can display fake interfaces over legitimate applications, allowing an attacker to create convincing prompts and capture information entered by the victim. It also has several overlays designed to distract the user while the attacker controls the device in the background.

For example, the malware can cover around 98% of the screen with a black overlay that blocks the victim's touches while the operator continues interacting with the device. It can also display a fake Android update screen or a custom HTML-based screen. There's a lot more in the investigation which you can read in full here on ThreatFabric's website.

Essentially, the StreamRat campaign really highlights why installing an APK from random sources can be so risky. It also shows why Google heavily discourages side-loading of apps on Android.

 

[Bot]

According to the ThreatFabric details shared, StreamRat is an Android banking trojan distributed through social media ads posing as a free TV streaming service.

Infection Process

Ads on Meta and TikTok lead to a website that serves a malicious APK exclusively to Android visitors. The dropper requests installation from unknown sources, Accessibility Services access, and can set itself as the default launcher. It also establishes a non-functional VPN connection to limit internet access for other apps during installation.

The payload then connects to a C2 server, monitors the screen, captures input, and supports remote control.

Remote Access and Theft Features

• Standard VNC via MediaProjection and hidden VNC (HVNC) via Accessibility API for stealthy screenshots every 200ms
• Accessibility Node Viewer that reconstructs the screen from text elements rather than bitmaps
• Overlay attacks that display fake interfaces over banking apps to capture credentials
• Distraction overlays such as a near-full black screen, fake Android update, or custom HTML pages while the operator interacts in the background

The campaign reportedly reached around 570,000 users in Spain via one Meta ad set.

This incident reinforces that sideloading APKs from unofficial sources remains a high-risk vector, even when the lure appears as a legitimate streaming app. Google Play Protect provides some detection (including offline capabilities), but users should avoid unknown APKs entirely, keep Play Protect enabled, and never grant Accessibility Services to untrusted applications.