Listen to the episode
TLDR
A malvertising campaign reaching roughly 570,000 Meta users promoted a fake free TV streaming service to push the StreamRat Android banking trojan. Ads ran on Instagram, Facebook, and TikTok, primarily targeting Spanish speaking users in...
How it works
A malvertising campaign reaching roughly 570,000 Meta users promoted a fake free TV streaming service to push the StreamRat Android banking trojan. Ads ran on Instagram, Facebook, and TikTok, primarily targeting Spanish speaking users in...
Red flags
- Streaming ads on social feeds that require installing an app outside Google Play. The site asks you to enable "installations from unknown sources" or change browser settings before downloading. A freshly installed app requests Accessibility, Device Admin, or default launcher permissions unrelated to streaming
What to do
- 1Install streaming and banking apps only from Google Play, verifying developer name, reviews, and history. Never enable sideloading or "unknown sources" based on instructions from an ad, DM, or unfamiliar website. If you installed the app, disconnect from Wi Fi/data, revoke its permissions, uninstall it, change banking pas
Source
malwarebytes
Source reviewed by Mythos Forensic Team
https://www.malwarebytes.com/blog/news/2026/09/streamrat-android-malware-spreads-through-meta-and-tiktok-adsFAQ
Is StreamRat malware spreads via Meta and TikTok ads posing as free TV streaming a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
Streaming ads on social feeds that require installing an app outside Google Play. The site asks you to enable "installations from unknown sources" or change browser settings before downloading. A freshly installed app requests Accessibility, Device Admin, or default launcher permissions unrelated to streaming
What should I do first?
Install streaming and banking apps only from Google Play, verifying developer name, reviews, and history. Never enable sideloading or "unknown sources" based on instructions from an ad, DM, or unfamiliar website. If you installed the app, disconnect from Wi Fi/data, revoke its permissions, uninstall it, change banking pas
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.