The free TV app in that Facebook ad hands your phone to someone else

The ad looked like a thousand others: a free app to watch TV channels, in Spanish, with a big download button. Behind it sat StreamRat, a new Android trojan that researchers at ThreatFabric described on 2 September and Malwarebytes wrote up the next day. Meta's own ad library shows roughly 570,000 accounts in the EU saw the banners between 11 June and 3 July, and the same creatives ran on TikTok. Nearly all of the observed victims were in Spain.

The clever part isn't the malware, it's the coaching. The download site checks that you're on Android before it shows anything, then offers a file called app.apk and walks you, step by step, through turning on "install from unknown sources" and granting the app Accessibility access. Every warning Android throws up is explained away as a normal part of setup. Once Accessibility is granted, StreamRat can read whatever is on screen, record what you type, lay a fake login page over your real banking app, block the screen with a bogus "updating" message while someone else uses the phone, and control the device remotely without you seeing it.

The rule that would have stopped all of it is short: a website that teaches you how to get past a security warning is the warning. Apps come from Google Play, full stop, and no streaming app needs Accessibility permission. If you installed something like this, remove it, then change the passwords for banking and email from a different device, because the phone may still be watched.

The same trick exists on Windows, where a download page explains how to click past SmartScreen. Tendvane's Safety check looks for the unwanted software that tends to arrive that way, though it won't remove malware; that's your antivirus's job.