StreamRAT is a new Android banking trojan that gives criminals broad control of an infected phone. It pairs streaming offers with screen viewing, remote actions and deceptive login windows, turning an app download into an account takeover.

The campaign targeted Spanish-speaking Android users through advertisements on Meta platforms and TikTok. One observed advertising push reached 570,000 Meta users between 11 June and 3 July 2026, mainly in Spain. It identified the malware while tracking the streaming-themed Steamtv Esp campaign.

The operators used a phishing site and a multi-stage installation process to steer visitors toward installing an Android package outside official channels.

Threat Fabric said in a report shared with Cyber Security News (CSN) that the download chain drew on a GitHub repository linked to Mirax distribution, showing how the operators reused delivery infrastructure while changing the final payload.

Scam web page (Source - Threat Fabric) — Scam web page (Source – Threat Fabric)

The operation matters because StreamRAT blends banking fraud functions with tools that let an operator watch and manipulate a device in real time.

Its control panel also appears designed for a malware-as-a-service model, which could allow customers to run campaigns using the same framework.

StreamRAT Uses VNC and Accessibility for Device Control

After installation, StreamRAT asks the victim to enable Android Accessibility Services, a legitimate feature intended to assist users.

In the wrong hands, that permission can read what is on screen and perform actions such as taps, swipes, returning home or opening notifications, as seen in other Android banking malware campaigns.

The trojan supports two viewing modes. Its VNC option uses Android’s screen-capture system, while hidden VNC takes repeated screenshots through Accessibility without a direct screen-sharing indicator. Both give attackers a view of the phone and support remote interaction.

StreamRAT can also rebuild the screen as structured interface text, capture typed data, list installed applications and show credential-stealing overlays.

Dropper execution (Source - Threat Fabric) — Dropper execution (Source – Threat Fabric)

A black screen or a fake update screen can block the victim’s touch input while the operator continues working in the background, a pattern related to abuse of Android accessibility.

The result is more than spying. An operator can monitor the app a victim opens, deliver a matching fake page, collect details entered there and use intercepted unlock information to access the device. That combination puts banking sessions, messages and other sensitive accounts at risk.

Delivery Chain and Evasion Risks

The infection begins with social-media advertisements posing as a free television-streaming service. The lure site checks whether a visitor uses Android, adjusts its instructions for the app used to open it and guides the person through enabling unknown-source installation and Accessibility permissions.

A first-stage dropper tries to become the default home application, keeping the victim inside its interface when they press the Home button. It then retrieves and installs the final payload.

Similar social engineering has featured in phone based banking fraud, where attackers rely on urgency and familiar-looking screens rather than a software flaw.

Before downloading the final malware, the dropper can create a deliberately broken VPN connection that disrupts internet access while excluding itself.

Executed dropper turned off the VPN connection (Source - Threat Fabric) — Executed dropper turned off the VPN connection (Source – Threat Fabric)

Researchers assess this may hinder online reputation checks or cloud-based analysis, although it does not fully defeat offline protection.

StreamRAT communicates with its command server through WebSocket connections and avoids wasting bandwidth by skipping duplicate screen and interface data.

That engineering focus mirrors the WebSocket mobile threat evolution seen in other Android threats and suggests an effort to make remote operations reliable at scale.

Users should avoid APK downloads offered through advertisements, messages or unofficial websites, especially services promising free streaming or urgent updates.

They should deny unexpected requests for Accessibility, unknown-app installation or VPN access, and remove unfamiliar apps promptly. An app that combines installation capability with VPN permissions deserves immediate scrutiny.

For organisations, mobile-device monitoring should flag unusual Accessibility activity, unexpected screen-capture requests, default-launcher changes and newly installed apps from outside managed stores.

Security teams can also watch for the indicators below, while treating the values as detection leads rather than proof that every matching device is compromised.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	`e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c`	StreamRAT-related Android application sample
Package name	`io.base.one887`	Package associated with the StrεαmTV Pro application
Application name	`StrεαmTV Pro`	Application name used by the StreamRAT-related sample
SHA-256	`ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3`	StreamRAT-related Android application sample
Package name	`io.meat.hint`	Package associated with the Sistema de vídeo application
Application name	`Sistema de vídeo`	Application name used by the StreamRAT-related sample
C2 IP address	`45.147.28[.]59`	StreamRAT command-and-control infrastructure
C2 IP address	`193.32.2[.]245`	StreamRAT command-and-control infrastructure

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post New StreamRAT Android Trojan Gives Hackers Full Remote Control Through VNC and Accessibility appeared first on Cyber Security News.