According to ThreatFabric, the ad campaign was designed to appear legitimate, enticing users to download a streaming service that actually carried the malicious payload. Once installed, StreamRat grants its operators extensive control over the infected device, functioning as a full-featured remote access tool (RAT). This includes the ability to steal credentials, intercept two-factor authentication codes, read and send SMS messages, and even capture screen content in near real-time.

The trojan's capabilities go beyond typical banking malware, as it can also manipulate device settings, install additional payloads, and potentially lock users out of their own devices. The campaign underscores a growing trend where malware distributors abuse legitimate advertising networks to target specific linguistic and geographic groups, bypassing traditional email-based phishing vectors.

For Android users, especially those in Spanish-speaking regions, this serves as a reminder to only download applications from the official Google Play Store and to scrutinize app permissions carefully.

• Target vector: Malicious Meta ads promoting a fake TV streaming app.
• Primary region: Spain / European Union.
• Impact: Full device takeover, credential theft, SMS interception, and screen capture.
• Distribution: Third-party APK downloads (not via official store).

Source: The Hacker News

Has your organization taken steps to block sideloaded APK installations on managed devices, or are you still relying on user awareness alone to prevent such infections?