StreamRat Malware Warning: Android Malware Spread Through Facebook and TikTok Ads
12 Oct 2026
Android smartphone users still need to be more cautious when downloading and installing applications, as security researchers have discovered a new malware campaign named StreamRat, which is being spread through advertisements on popular social media platforms such as Facebook, Instagram, and TikTok
A report from Malwarebytes states that StreamRat is a type of RAT (Remote Access Trojan) malware that can remotely control the victim's device. It also combines features of Banking Trojan and Infostealer malware, enabling it to cause various types of damage
The malware can track activities on the victim's device, including capturing data entered through various applications. Additionally, it uses an Overlay Attack technique to create fake screens over real applications, tricking users into entering passwords or important information, which may then be forwarded to the attackers
Deception through streaming app ads
Research teams have found that the campaign began spreading in Spain through Meta platforms like Facebook and Instagram from July 3, before expanding to TikTok later on
Attackers use advertisements claiming to be streaming service applications to attract users to click on links. Once the victim clicks, the system directs them to a website prepared for spreading malware
The destination website meticulously checks the visitor's information, including the operating system of the device and the source of the visit, to filter out those who are not the target group. It also adjusts the messages displayed to suit the channel through which the victim accessed
One method used by the campaign is to instruct Android users to enable settings that allow the installation of applications from unknown sources, which is a major avenue through which victims can install dangerous apps on their devices
Android users advised to avoid apps from unknown sources
To mitigate risks, users should avoid downloading applications from advertisement links or websites that cannot verify their source, and should primarily download apps from official stores, such as the Google Play Store
Additionally, if a website or application requests users to enable the installation of apps from unknown sources without a clear reason, it should be carefully considered, as such settings may open the door for malware to be installed on the device
For users of Malwarebytes products, the company states that it can detect components of StreamRat under detection names such as Android/Trojan.Agent.ACRAEEF8A36H36, Android/Trojan.Agent.ACR02DB0614H7, and Android/Trojan.Dropper.ACR9B7ECE83D1
The case of StreamRat is another example that shows users should not trust advertisements on social media simply because they present in the form of applications or services that seem reliable, and should verify the source of downloads before installing any app
Source: www.malwarebytes.com
Other related
Warlock, Ransomware, Malware, Microsoft SharePointWarlock Ransomware Breaches Organizations via SharePoint, Disabling Security Defenses for Up to 2 Hours
IT News, Safari, Apple, Adaptive Dark ModeSafari Tests Adaptive Dark Mode, a Feature That Automatically Converts Websites to Dark Mode
IT News, Microsoft Edge, PDF
