The malware campaign, tracked as “Steamtv Esp,” abuses interest in free IPTV and streaming content. Victims who click malicious advertisements are sent to a phishing site that appears to offer a TV-streaming application.
The site checks whether visitors use Android devices and hides the download option from non-Android users. Users who proceed are instructed to enable installation from unknown sources and grant Android Accessibility permissions.
The downloaded APK is a dropper linked to infrastructure previously associated with the Mirax banking trojan. However, the final payload is a previously unseen malware family, now named StreamRat.
The campaign reflects a wider mobile-malware trend in which attackers use pirated sports, movie, and IPTV applications as lures.
ThreatFabric has observed similar streaming-themed campaigns across several countries, using social-media ads to direct victims to malicious Android apps.
StreamRat Hijacks Android Devices
After installation, the dropper attempts to become the device’s default launcher. This means pressing the Android Home button can redirect the victim back to the malicious app interface, helping the attackers maintain control during the infection process.
The dropper also downloads the StreamRat payload into the public Downloads folder under a filename such as update_{timestamp}.apk.
It then requests permission to install the second-stage application and launches it. A notable technique involves a deliberately non-functional VPN connection.
Before downloading the final payload, the dropper asks for VPN permission and routes most device traffic through a connection that does not forward data. The malware itself is excluded from this VPN.
This can temporarily cut off internet access for other applications, potentially disrupting cloud-based reputation checks or online security analysis.
Once StreamRat is installed and running, the dropper disables the VPN so the trojan can communicate with its command-and-control server.
Once Accessibility Services access is granted, StreamRat collects device details, including the installed-app list, and sends the information to its command server.
It monitors the foreground application, captures user input, and checks whether a targeted banking or financial application is open.
The trojan uses WebSocket-based communications and sends device fingerprints through custom headers containing the device identifier, model, and Android API level.
It also compresses and deduplicates screen captures using Adler-32 checksums, reducing bandwidth use while preserving remote-access capability.
ThreatFabric said StreamRat’s operator panel includes device management, overlay injection tools, payload builders, user roles, logs, and Telegram notification settings.
These features indicate the malware may be designed for a Malware-as-a-Service operation, enabling affiliates to distribute the trojan through their own advertising and phishing campaigns.
Android users should avoid installing streaming, IPTV, or sports-viewing apps from advertisements, unofficial websites, or unknown sources.
A streaming app requesting Accessibility access, VPN access, launcher privileges, or installation permissions should be treated as a major warning sign.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
