StreamRat Meta ad campaign targeting Spanish-speaking users
Campaign
Summary
Hide ▲
Show ▼
A Meta ad campaign is pushing StreamRat to Spanish-speaking users, expanding exposure to an Android banking trojan that can steal credentials and take over devices. The lure focused on Spain and used a fake television-streaming theme to drive users toward an APK download flow. It reached an estimated 570,950 Meta accounts in the European Union at least once.
Related Happenings
StreamRat Android banking trojan with remote-control capabilities
Malware Activity
H score42
First: 02.09.2026 15:22
Last: 02.09.2026 15:22
Sources 1
How related:
Cybersecurity researchers have disclosed details of a new Android banking trojan called StreamRat that was promoted to Spanish-speaking users through a fake television-streaming campaign on Meta and can give operators near-complete control of infected devices.
About this happening:
The StreamRat Android banking trojan is being pushed through fake streaming ads on Meta and can yield near-complete device control, raising the risk of credentia...
StreamRat Android banking trojan with remote-control capabilities
Malware ActivityHow related: Cybersecurity researchers have disclosed details of a new Android banking trojan called StreamRat that was promoted to Spanish-speaking users through a fake television-streaming campaign on Meta and can give operators near-complete control of infected devices.
About this happening: The StreamRat Android banking trojan is being pushed through fake streaming ads on Meta and can yield near-complete device control, raising the risk of credentia...
Lurking Lizard trojanized 7-Zip installer campaign
Campaign
H score84
First: 09.07.2026 07:01
Last: 09.07.2026 07:01
Sources 1
About this happening:
A Lurking Lizard campaign used a trojanized 7-Zip installer to recruit devices as proxy nodes, expanding a residential-proxy operation that has run since at least Au...
Lurking Lizard trojanized 7-Zip installer campaign
CampaignAbout this happening: A Lurking Lizard campaign used a trojanized 7-Zip installer to recruit devices as proxy nodes, expanding a residential-proxy operation that has run since at least Au...
Sniper Dz MENA fake Facebook phishing and monetization campaign
Campaign
H score30
First: 15.06.2026 09:30
Last: 15.06.2026 09:30
Sources 1
About this happening:
A Sniper Dz fraud campaign is targeting users across the Middle East and North Africa with fake Facebook accounts that impersonate politicians, public figures, and tru...
Sniper Dz MENA fake Facebook phishing and monetization campaign
CampaignAbout this happening: A Sniper Dz fraud campaign is targeting users across the Middle East and North Africa with fake Facebook accounts that impersonate politicians, public figures, and tru...
TikTok and Instagram Reels Vidar social-engineering campaign
Campaign
H score37
First: 10.06.2026 19:00
Last: 10.06.2026 19:00
Sources 1
About this happening:
A TikTok and Instagram Reels campaign is using fake free-software tutorials to push Vidar, turning social feeds into a high-reach malware delivery channel. The operati...
TikTok and Instagram Reels Vidar social-engineering campaign
CampaignAbout this happening: A TikTok and Instagram Reels campaign is using fake free-software tutorials to push Vidar, turning social feeds into a high-reach malware delivery channel. The operati...
Asin Android spyware distribution through fake utility, PDF, and war-map apps
Malware Activity
H score22
First: 05.06.2026 17:53
Last: 05.06.2026 17:53
Sources 1
About this happening:
The Asin Android spyware activity is being distributed through fake utility, PDF, and war-map apps, putting Arabic-speaking users at risk of covert surveillance on Andro...
Asin Android spyware distribution through fake utility, PDF, and war-map apps
Malware ActivityAbout this happening: The Asin Android spyware activity is being distributed through fake utility, PDF, and war-map apps, putting Arabic-speaking users at risk of covert surveillance on Andro...
Timeline
-
02.09.2026 15:22 1 articles · 1h ago
Researchers disclose StreamRat Android banking trojan
Initial DisclosureCybersecurity researchers disclosed StreamRat as a new Android banking trojan promoted through a fake television-streaming campaign on Meta that targeted Spain and could give operators near-complete control of infected devices after victims sideloaded an APK and granted permissions. ThreatFabric said the advertisement reached an estimated 570,950 Meta accounts in the European Union at least once, while totals for infected devices and confirmed victims remained unreported.
Show sources
- Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control — thehackernews.com — 02.09.2026 15:22
-
02.09.2026 03:00 2 articles · 14h ago
StreamRat Meta ad campaign begins targeting Spain
Campaign Scope UpdateA Meta advertising campaign promoting StreamRat starts with a fake television-streaming lure aimed at Spanish-speaking Android users. The lure directs visitors to a specially crafted website that serves an APK download path for the malware campaign.
Show sources
- Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control — thehackernews.com — 02.09.2026 15:22
- Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control — thehackernews.com — 02.09.2026 15:22
-
02.09.2026 03:00 1 articles · 14h ago
StreamRat Meta ad campaign ends
Campaign Scope UpdateThe Meta promotion for StreamRat stops after running through early July 2026. The same campaign had focused on Spain and used the fake television-streaming lure to drive Android users into the APK installation flow.
Show sources
- Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control — thehackernews.com — 02.09.2026 15:22