StreamRAT Abuses Android Accessibility, MediaProjection and HVNC for Full Device Takeover

StreamRAT, a newly identified Android banking trojan distributed through fake free-TV streaming advertisements on Meta and TikTok.

The campaign, tracked as “Steamtv Esp.,” primarily targeted Spanish-speaking Android users and exposed an estimated 570,000 Meta users between June 11 and July 3, 2026.

The operation highlights the continued effectiveness of piracy-themed social engineering. Victims who clicked streaming advertisements were redirected to a phishing site that selectively enabled downloads only for Android devices.

The site then tailored installation instructions based on whether the visitor arrived via Instagram, Facebook, TikTok, or a browser, guiding them to allow unknown-source installs and enable Android Accessibility Services.

The StreamRAT campaign uses a staged APK delivery model. The initial application is a dropper resembling tooling previously used to distribute the Mirax banking trojan, with its payload hosted in a GitHub repository tied to the same actor.

ThreatFabric said the actor has also used the GodFather malware family, indicating an operator familiar with Android financial-fraud ecosystems.

The dropper uses HTML and embedded JavaScript pages, including set_launcher.html, index.html, and vpn_required.html, to manage the infection process.

It attempts to make itself the device’s default launcher, ensuring that pressing the Home button returns the victim to its interface.

It subsequently downloads the final APK as update_{timestamp}.apk into the public Downloads directory and installs it using Android’s session-based package installation mechanism.

A notable evasion feature is its temporary internet-blocking capability. Before fetching the final payload, the dropper establishes a deliberately non-functional VPN tunnel that routes all device traffic through it while excluding the dropper itself.

Because no traffic is forwarded, other applications lose connectivity until the payload is installed and launched.

ThreatFabric assesses that this likely impairs cloud-based reputation checks and code analysis rather than fully bypassing Google Play Protect’s offline detections.

After installation, StreamRAT requests Android Accessibility Services privileges and connects to a hardcoded command-and-control server over WebSocket.

The malware fingerprints the device through custom headers carrying the device ID, model, and Android API level, then sends installed-app inventories in chunks of up to 50 entries.

Accessibility access allows StreamRAT to monitor foreground applications, capture user-entered data, inspect interface elements, simulate taps and swipes, invoke Home or Back actions, and steal credentials through HTML overlays.

ThreatFabric Researchers said that, broader use of IPTV and sports-streaming lures to distribute Android malware across Spain, Portugal, Italy, Turkey, and India.

StreamRAT Abuses Android

When a target app comes into view, the malware sends maintenance_check and injection_check requests containing its package name, allowing operators to deliver a banking overlay matched to the application currently open on the device.

The malware can also collect the complete Accessibility UI tree, including text, bounds, buttons, and other interface elements.

This gives operators a lightweight, text-based reconstruction of the screen without continuously transmitting screenshots. StreamRAT applies Adler-32 checksums to avoid resending unchanged UI data, reducing C2 traffic and backend overhead.

StreamRAT supports two remote viewing modes. Its VNC feature abuses Android’s MediaProjection API to capture the full device display through createVirtualDisplay() and ImageReader.

The malware scales frames to 35% of their original dimensions and encodes them as WebP images at quality 40, transmitting only frames whose Adler-32 checksum differs from the previous capture.

MediaProjection normally requires consent and can show a screen-sharing indicator in the Android status bar.

However, StreamRAT uses its existing Accessibility privileges to interact with the native capture dialog and select full-screen, all-app sharing.

Android’s MediaProjection framework is intended for legitimate recording and casting, but it can be misused to capture sensitive foreground content when users grant permission.

Its more covert HVNC mode captures screenshots every 200 milliseconds through Accessibility API calls.

Unlike MediaProjection streaming, this method does not directly expose a visible screen-sharing indicator, enabling attackers to observe a victim’s activity with less chance of detection.

The StreamRAT backend includes device management, campaign statistics, injection and maintenance-overlay management, command logs, payload and dropper builders, and role-based accounts for users, supervisors, and administrators.

Those features strongly suggest that StreamRAT was built as a Malware-as-a-Service platform, in which customers handle distribution while developers provide the malware and management infrastructure.

For defenders, an Android application that combines sideloading prompts, default-launcher changes, VPN configuration, Accessibility requests, and unexpected screen-capture activity should be treated as a high-risk indicator.

MITRE ATT&CK maps Android screen-capture abuse to technique T1513 and recommends restricting permitted Accessibility Services through enterprise mobility controls, while users should reject unexpected screen-sharing and accessibility-permission requests.

Indicators of Compromise

SHA-256	Package name	Application name	C2
e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c	io.base.one887	StrεαmTV Pro
ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3	io.meat.hint	Sistema de vídeo	45.147.28[.]59   193.32.2[.]245

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.