Fake TV Streaming Ads on Facebook Pushed a New Android Banking Trojan to Spanish Users

Key points

• Researchers at ThreatFabric have named a new Android banking trojan StreamRat, a piece of malicious software that hides inside what looks like a free TV streaming app.
• The operators promoted the fake app through paid ads on Meta's platforms, targeting Spanish speakers in Spain.
• The ad campaign reached an estimated 570,950 accounts across the European Union before being flagged.
• Once installed, StreamRat can read screens, steal banking logins, and give operators near-complete remote control of the phone.
• The lure was a fake television-streaming service, chosen because free-TV apps get clicked without much thought.

A new Android banking trojan is doing the rounds in Spain, and the delivery route is depressingly familiar: paid ads on Facebook and Instagram.

The malware is called StreamRat. Researchers at Dutch mobile-fraud firm ThreatFabric say the operators dressed it up as a free television streaming app, then bought ads on Meta's platforms to push it at Spanish-speaking users. ThreatFabric is a source we've followed since August: our earlier story on their Manic Android malware findings from 20 August showed the same firm tracking a trojan that targeted 169 apps across Ukrainian banking customers. The StreamRat campaign reached roughly 570,950 accounts inside the European Union before it was spotted.

Once a victim installs the app, the attackers get something close to full remote control of the phone. That's the important bit for anyone who does their banking on a handset, which is most of us.

What does StreamRat actually do once it's on your phone?

It watches and steals. StreamRat is a remote access trojan, meaning software that lets a criminal operate the phone as if they were holding it. It can read what's on screen, press buttons on its own, and pull out passwords and banking codes.

The failure mode here is Android's accessibility permissions. These are the same permissions that let screen readers help blind users. If a malicious app tricks you into granting them, and free-app installers are very good at that dance, it can see every tap and inject its own. Banking apps, two-factor codes, wallet apps: all of it becomes readable.

The first reporting on StreamRat came via The Hacker News, drawing on ThreatFabric's analysis.

How did the criminals get their app in front of so many people?

They paid for it. That's the uncomfortable part. Rather than hacking anything clever, the operators simply bought ads on Meta and let the algorithm find people who click on free-TV promos.

Meta's ad review is supposed to catch this. It doesn't, reliably. Every post-mortem on this class of campaign reaches the same conclusion: ad-network moderation at scale is a losing game against a determined seller who keeps rotating accounts and creatives.

What the campaign looked like

Should ordinary phone users be worried?

Only if you install apps from outside the Google Play Store, which is exactly what this campaign talked people into doing. The safer habit is boring: install apps only from the Play Store, and treat any ad promising free premium TV as a scam by default.

A few practical steps if you clicked something like this recently:

• Open Settings and then Apps, removing anything you don't remember installing, especially anything holding Accessibility access.
• Check your bank's app for logins or transfers you didn't make, and call the bank if anything looks off.
• Change your banking password from a different device, not the phone you suspect.
• Run Google Play Protect from the Play Store's menu, which scans installed apps.

This isn't the last Meta-ad malware campaign we'll write about this year. Banking trojans have discovered marketing budgets, and a working install costs less than the payout from a drained account. If an ad's selling you free TV, the product is you.