Researchers reported a real malvertising campaign where ads on Meta platforms promoted a fake TV-streaming app to Spanish-speaking users, leading them to sideload an Android app. After victims approved a chain of permissions (including Accessibility), the StreamRat trojan could remotely control the device and steal credentials.
The StreamRat campaign started with ads on Meta platforms promoting a fake TV-streaming app to Spanish-speaking users. Researchers estimated the campaign was capable of reaching over 570,000 Meta accounts in the EU. Clicking the ad led victims to a crafted website that checked the visitor's operating system and only displayed a download button to Android devices, steering them toward sideloading a file named app.apk instead of using an official app store.
Once installed, the dropper walked victims through a chain of permission requests framed as normal setup steps. It asked to become the device's default Home application, requested a VPN connection before fetching the final payload, and asked for permission to install apps from unknown sources. The final step requested Accessibility access. Once granted, the malware connected to its command-and-control server and gained the ability to capture keystrokes, display credential-stealing overlays, and remotely control the device. StreamRat also used screen-capture methods, including a MediaProjection consent dialog and an Accessibility-based screenshot technique, to observe user activity.
The lure worked because it mimicked a familiar, low-friction experience: clicking an ad, visiting a website, and downloading an app to watch streaming content. By tailoring the download prompt specifically to Android visitors and breaking the permission requests into a sequence of small, seemingly reasonable steps, the operators reduced the chance that any single request would raise suspicion. Each permission on its own (Home app, VPN, unknown sources, Accessibility) could be rationalized as part of a normal app setup flow.
Organizations with BYOD or personal Android device use should reinforce that legitimate apps rarely need Accessibility access, and that installation prompts asking for system-level control unrelated to the app's stated purpose are a strong signal to stop. Awareness efforts should highlight that stopping the install at any point in this chain, especially before granting Accessibility access, prevents the credential theft and remote control capabilities that make StreamRat effective. Treating unsolicited app-download ads and sideloading requests as high risk, regardless of how convincing the pretext, remains one of the most effective defenses against this kind of malvertising-driven attack. Techniques referenced in this campaign map to phishing via social media (attack.mitre.org/techniques/T1566/003), malicious file execution via user interaction (attack.mitre.org/techniques/T1204/002), and impairing device availability or control (attack.mitre.org/techniques/T1656).
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
StreamRat is an Android banking trojan that was promoted to Spanish-speaking users through a fake TV-streaming campaign run via ads on Meta. Once installed, it uses Accessibility permissions to steal credentials and remotely control the device.
A social media ad led users to a crafted website that showed a download button only to Android visitors, prompting them to sideload an APK file named app.apk outside the official app store.
Once Accessibility access is granted, the malware can capture keystrokes, display credential-stealing overlays, inspect the visible interface, and control the device remotely.
Red flags include being asked to sideload an APK, a streaming app requesting to become the default Home app, requests to enable a VPN during setup, and permission requests unrelated to the app's stated purpose.
You’re scrolling Meta and see an ad: “Instala StrεαmTV Pro, APK download for Android.” Looks legit, right? Tap it, and a website opens that quietly checks your device. On Android, it shows one big button: download app.apk from outside the app store. During install, this “streaming” app suddenly wants to be your default Home app, start a VPN, allow installs from unknown sources, and get Accessibility access. That’s StreamRat setting up full remote control. Here’s the move: if any “streaming” app asks for Accessibility, Home, VPN, or unknown-sources during install, stop right there and delete the app.
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
Researchers report that the WeedHack malware campaign is still infecting people through convincing fake Minecraft client/mod websites, even after its command-and-control server was disrupted. Attackers use SEO poisoning and trusted community platforms (like Discord and Minecraft modding sites) to…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
Researchers showed that a single public GitHub issue (from someone with no repo access) could steer popular AI coding agents into running dangerous commands, exposing tokens, and changing repositories. The risk comes from AI agents reading untrusted issue/PR text while also having access to…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
Kaspersky reported that Iran-linked APT Mirage Kitten approached software engineers on LinkedIn using fake recruiter personas and sent “coding challenges” that were actually trojanized projects. The lure used legitimate-looking cloud hosting (Amazon S3) and even instructed victims not to use AI…
