StreamRat Android malware spreads through Meta and TikTok ads

A malicious ad campaign targeted Spanish-speaking users (mainly in Spain) by promoting a fake free TV-streaming service that led Android visitors to sideload an APK delivering the StreamRat Android banking trojan/infostealer. The campaign — observed on Meta and TikTok with roughly 570,000 ad impressions — used tailored landing pages to instruct victims to enable install-from-unknown-sources and grant Accessibility and other high-risk permissions; StreamRat can capture screens and keystrokes, present fake UI overlays, and allow remote control. The report includes Malwarebytes detection names, technical behavior, and user mitigation and removal guidance.