Fake Streaming Ads on Meta Deploy New Android Banking Trojan, StreamRat, to Spanish‑Speaking Users

Cybersecurity researchers have uncovered a novel Android banking trojan, dubbed StreamRat, that is being distributed through a deceptive television‑streaming advertisement campaign on Meta platforms. The ads, targeted at Spanish‑speaking audiences, lure users with promises of free streaming content, but instead install the malicious software on their devices.

According to the analysis released by the security firm ThreatFabric, StreamRat grants its operators near‑complete control over compromised phones. Once installed, the trojan can intercept two‑factor authentication codes, capture login credentials for banking apps, and even manipulate the device’s system settings to evade detection. Its capabilities extend to remote command execution, allowing attackers to download additional payloads or exfiltrate personal data at will.

The campaign appears to exploit Meta’s advertising infrastructure, creating a veneer of legitimacy for the fraudulent offers. By presenting the lure as a legitimate streaming service, the attackers increase the likelihood that users will click through and grant the requested permissions during the installation process. The focus on Spanish‑language content suggests a strategic targeting of regions where mobile banking adoption is high and users may be less familiar with the nuances of Android security prompts.

StreamRat is part of a broader trend of banking trojans that blend social engineering with sophisticated technical capabilities. Researchers note that similar malware families have previously used fake app stores, SMS phishing, and malicious links to reach victims. The emergence of a trojan delivered via a major social media ad network underscores the evolving attack surface, where legitimate platforms can inadvertently become conduits for malware distribution if ad vetting processes fail.

ThreatFabric recommends that users exercise caution when encountering unsolicited streaming offers, especially those that require the installation of unknown applications. Keeping devices updated, installing security software, and reviewing app permissions before granting access are essential defensive steps. Meanwhile, Meta has been urged to tighten its ad‑review mechanisms to prevent future misuse of its platform for malicious campaigns. The discovery of StreamRat highlights the ongoing need for coordinated efforts between security researchers, platform providers, and users to curb the spread of mobile banking threats.