StreamRAT Abuses Android Accessibility, MediaProjection and HVNC for Full Device...

1. Executive Summary

StreamRAT is a newly identified Android banking trojan distributed via fake free-TV streaming advertisements on Meta and TikTok. The campaign, tracked as “Steamtv Esp.,” targeted Spanish-speaking Android users, exposing an estimated 570,000 Meta users between June 11 and July 3, 2026. The malware abuses Android Accessibility, MediaProjection, and HVNC for full device takeover. Active exploitation is not established in cited evidence beyond the reported campaign window. Immediate action requires monitoring for unauthorized accessibility services and media projection requests.

2. Key Judgements

• The threat leverages legitimate Android APIs (Accessibility, MediaProjection) to achieve persistent, high-privilege control, making traditional signature-based detection insufficient.
• The distribution vector relies on social engineering via paid advertising platforms, indicating a sophisticated, resource-backed operation targeting specific linguistic demographics.
• Full device takeover implies potential for credential theft, financial fraud, and further lateral movement, necessitating immediate containment of affected endpoints.
• Attribution to a specific actor group is not established in cited evidence; the campaign name “Steamtv Esp.” is a tracking label, not a confirmed actor identity.

3. Verified Facts

• StreamRAT is an Android banking trojan.
• Distribution occurred via fake free-TV streaming advertisements on Meta and TikTok.
• The campaign is tracked as “Steamtv Esp.”
• Targeting focused on Spanish-speaking Android users.
• An estimated 570,000 Meta users were exposed between June 11 and July 3, 2026.
• The malware abuses Android Accessibility, MediaProjection, and HVNC for full device takeover.

4. Threat Classification

StreamRAT is classified as a banking trojan with remote access capabilities. It falls under the category of mobile malware that exploits platform-specific APIs to maintain persistence and control. The use of HVNC (HTML5 Virtual Network Computing) indicates a capability for real-time remote control of the device interface. The threat is categorized as high-severity due to its ability to achieve full device takeover and its targeted distribution via major social media platforms.

5. Threat Severity Assessment

The severity is assessed as High. The combination of full device takeover, banking trojan functionality, and large-scale exposure (570,000 users) presents a significant risk to financial integrity and user privacy. The use of legitimate APIs complicates detection and increases the dwell time of the malware. The targeted nature of the campaign suggests a high level of operational sophistication, warranting immediate defensive action.

6. Evidence & Source Assessment

The primary source is GBHackers Security, a reputable cybersecurity news outlet. The evidence is based on a single source report, which limits the ability to cross-verify technical details. The source provides high-level technical indicators (Accessibility, MediaProjection, HVNC) but lacks detailed IOCs, code samples, or infrastructure details. Confidence in the existence and basic functionality of StreamRAT is High, but confidence in specific technical implementation details is Medium due to the single-source nature of the evidence.

7. Timeline & Chronology

• June 11, 2026: Campaign activity begins, with fake ads appearing on Meta and TikTok.
• June 11 – July 3, 2026: Estimated 570,000 Meta users exposed to the campaign.
• July 3, 2026: Campaign activity ends or is detected, leading to the identification of StreamRAT.
• September 3, 2026: GBHackers Security publishes the report detailing the StreamRAT threat.

8. Business Impact

For enterprises, the impact includes potential financial loss from banking fraud, reputational damage if employees are targeted, and operational disruption if corporate devices are compromised. The use of social media ads suggests that employees may be targeted outside of corporate networks, increasing the risk of credential theft and lateral movement. The need for immediate containment and remediation will require significant SOC and IR resources.

9. Enterprise Exposure Assessment

Enterprises with Spanish-speaking employees using Android devices for work are at elevated risk. Exposure is determined by the use of Meta and TikTok on corporate or personal devices used for work. Organizations should assess the number of Android devices in their fleet, particularly those used by Spanish-speaking staff. The use of fake ads indicates that users may be tricked into installing the malware, bypassing traditional endpoint security controls. Immediate action is required to identify and isolate affected devices.

10. Technical Analysis

StreamRAT abuses Android Accessibility services to gain persistent access to the device, allowing it to monitor and interact with the user interface. MediaProjection is used to capture the screen, enabling the attacker to view and record the user’s activities. HVNC provides a remote control interface, allowing the attacker to manipulate the device in real-time. These capabilities combine to achieve full device takeover, enabling credential theft, financial fraud, and further malicious activities. The use of legitimate APIs makes detection challenging, as the malware blends in with normal system behavior.

11. Report-Type Deep Dive

Delivery: Fake free-TV streaming advertisements on Meta and TikTok. Execution: Installation of StreamRAT on Android devices. Persistence: Abuse of Android Accessibility services. Privilege Behavior: Use of MediaProjection for screen capture and HVNC for remote control. Discovery: Not established in cited evidence. Credential Access: Implied by banking trojan functionality. C2: Not established in cited evidence. Collection/Exfiltration: Implied by screen capture and remote control capabilities. Evasion: Use of legitimate APIs to blend in with normal system behavior. Configuration: Not established in cited evidence. Infrastructure: Not established in cited evidence. IOCs: Not established in cited evidence. Detection Opportunities: Monitoring for unauthorized accessibility services and media projection requests.

12. MITRE ATT&CK Assessment

• T1556.002: Steal Web Browser Credentials (Inferred from banking trojan functionality).
• T1056.009: Audio Capture (Inferred from screen capture capabilities).
• T1056.001: Input Capture (Inferred from Accessibility service abuse).
• T1071.001: Web Protocols (Inferred from HVNC remote control).
• T1547.006: Accessibility Features (Explicitly mentioned in source).

13. Indicators & Observables

Not established in cited evidence. The source does not provide specific IOCs such as IP addresses, domains, file hashes, or process names. To resolve this, telemetry from affected devices is required, including logs of installed apps, accessibility service configurations, and network connections. Analysts should collect and analyze these data points to identify specific indicators associated with StreamRAT.

14. Detection Engineering Guidance

TELEMETRY SPECIFICATION / WITHHELD — INSUFFICIENT EVIDENCE. Required logs/fields: Android system logs for accessibility service changes, MediaProjection API calls, and network connections to unknown domains. Hypothesis: StreamRAT will trigger accessibility service changes and MediaProjection requests. Validation method: Correlate these events with known malicious app installations. False-positive considerations: Legitimate apps may also use these APIs; context is required. Promotion criteria: Confirmation of malicious intent through additional telemetry or sandbox analysis.

15. Detection Validation & Required Telemetry

To validate detections, collect the following telemetry: Android system logs for accessibility service changes, MediaProjection API calls, and network connections. Analyze these logs for patterns consistent with StreamRAT behavior. Validate detections by correlating these events with known malicious app installations. Ensure that false positives are minimized by requiring context, such as the presence of unknown apps or unusual network traffic. Promote detections to production only after validation with confirmed malicious samples.

16. Threat Hunting Queries

• Search for Android devices with recently changed accessibility service configurations.
• Identify devices with active MediaProjection sessions not initiated by known apps.
• Look for network connections to unknown or suspicious domains from Android devices.
• Correlate app installations with accessibility service changes to identify potential StreamRAT infections.

17. SOC Analyst Playbook

• Monitor for alerts related to unauthorized accessibility service changes on Android devices.
• Investigate alerts for MediaProjection API calls not associated with known apps.
• Review network traffic from Android devices for connections to suspicious domains.
• Isolate affected devices and collect forensic data for further analysis.
• Coordinate with IR team for containment and eradication of StreamRAT.

18. Incident Response & Containment Decision Plan

Immediate containment involves isolating affected Android devices from the network to prevent further data exfiltration. Eradication requires removing the StreamRAT app and resetting accessibility service configurations. Recovery involves restoring devices to a known good state and verifying that no residual malware remains. Recurrence prevention includes user awareness training on the risks of fake ads and enhanced monitoring for unauthorized API usage. Decision points include determining the scope of the incident and the need for forensic analysis.

19. Remediation & Validation Plan

• Remove the StreamRAT app from affected devices.
• Reset accessibility service configurations to default settings.
• Verify that no residual malware remains by scanning devices with updated security tools.
• Monitor devices for any recurrence of suspicious activity.
• Validate remediation by confirming that accessibility services and MediaProjection are no longer abused.

20. Executive Decision Matrix

21. Executive Recommendations

• Implement strict controls on Android device usage for corporate data, including MDM solutions that monitor accessibility services.
• Enhance user awareness training to educate employees on the risks of fake ads and social engineering.
• Deploy advanced endpoint detection and response (EDR) solutions capable of monitoring API usage on mobile devices.
• Establish a rapid response protocol for mobile malware incidents, including clear roles and responsibilities.
• Regularly review and update security policies to address emerging threats like StreamRAT.

22. Intelligence Gaps & Collection Requirements

• Specific IOCs for StreamRAT, including IP addresses, domains, and file hashes.
• Detailed technical analysis of the malware’s code and behavior.
• Information on the infrastructure used for C2 and data exfiltration.
• Attribution details to identify the actor group responsible.
• Telemetry from affected devices to validate detection logic.

23. Analytic Confidence & Limitations

Confidence in the existence and basic functionality of StreamRAT is High, based on the reputable source. However, confidence in specific technical details is Medium due to the single-source nature of the evidence. Limitations include the lack of detailed IOCs, code samples, and infrastructure information. These gaps hinder the ability to develop precise detection rules and conduct thorough forensic analysis. Additional evidence is required to increase confidence and provide actionable intelligence.

24. Forecast / Outlook

Given the effectiveness of the campaign and the sophistication of the malware, similar threats are likely to emerge. Attackers may continue to use social media ads for distribution, targeting specific demographics. The use of legitimate APIs for persistence and control will likely become more common, requiring enhanced detection capabilities. Organizations should expect an increase in mobile malware incidents and prepare accordingly. Confidence in this forecast is Medium, based on current trends and the capabilities demonstrated by StreamRAT.

25. References

• GBHackers Security: StreamRAT Abuses Android Accessibility, MediaProjection and HVNC for Full Device Takeover. https://gbhackers.com/streamrat-abuses-android/

🔗 Related Intelligence Reports

• Related topic: CVE-2026-82448 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-5680 — CVSS 7.5 HIGH Severity | NVD Vulnerability Record
• Related topic: Booba Project Ransomware Claims New Victim: Chernyy & Associates | Professional Services S
• Related topic: A Tale of Two SOCs: Insights From Two Red Team Assessments
• Related topic: CVE-2026-78161 — CVSS 7.3 HIGH Severity | NVD Vulnerability Record