Uncovering StreamRat From Meta Ads to Full Device Takeover

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://threatfabric.com/blogs/from-meta-ads-to-full-device-takeover-uncovering-streamrat
• Blog Title: Uncovering StreamRat: From Meta Ads to Full Device Takeover
• Suggested Section: Mobile Pentesting > Android Applications Pentesting; expand Accessibility Services Abuse and Android VPN Bypass, with related notes under Android Task Hijacking and WebView Attacks

🎯 Content Summary

Overview

StreamRat is a sophisticated Android banking trojan and remote-access trojan distributed to Spanish-speaking users through Meta and TikTok advertisements impersonating a free television-streaming service. One Meta campaign reached approximately 570,000 potential victims between 11 June 2026 and 3 July 2026, with most observed victims located in Spain. The threat actor has used at least three financial-malware families: 🔧 Technical Details

Default-launcher workflow trapping: A malicious Android dropper can ask to become the default Home application before completing installation. Every HOME-button press then returns the victim to attacker-controlled HTML pages, limiting the victim's ability to escape the workflow. After the final payload obtains Accessibility access, the dropper can relinquish the launcher role to reduce suspicion.

Cloud-analysis interference with a dead VPN: An Android dropper can create a VPN interface, route all device traffic through it, exclude itself, and deliberately omit traffic forwarding. Other applications and cloud-backed security products lose connectivity while the dropper can continue downloading and installing malware. Stopping the VPN after execution restores C2 connectivity. This may reduce online reputation and dynamic-analysis opportunities but does not defeat offline signatures.

Accessibility-based takeover without a software e...

🤖 Agent Actions

Updated:

src/generic-methodologies-and-resources/basic-forensic-methodology/android-malware-post-exploitation.md

Added concise coverage of:

• Default-Home/launcher workflow trapping.
• VPN blackholing as an anti-cloud-analysis technique.
• Foreground-package-triggered WebView injection overlays.
• Adler-32 deduplicated screenshot and Accessibility UI-tree streaming.
• Relevant reverse-engineering and hunting indicators.
• Numbered StreamRat source reference with inline citations.

Validation passed: git diff --check, reference numbering, citation count, forbidden-source check, and final banner placement. mdbook was unavailable locally.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://threatfabric.com/blogs/from-meta-ads-to-full-device-takeover-uncovering-streamrat

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting > Android Applications Pentesting; expand Accessibility Services Abuse and Android VPN Bypass, with related notes under Android Task Hijacking and WebView Attacks".

Repository Maintenance:

• MD Files Formatting: 998 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0