All About Cookies is an independent, advertising-supported website. Some of the offers that appear on this site are from third-party advertisers from which All About Cookies receives compensation. This compensation may impact how and where products appear on this site (including, for example, the order in which they appear).
All About Cookies does not include all financial or credit offers that might be available to consumers nor do we include all companies or all available products. Information is accurate as of the publishing date and has not been provided or endorsed by the advertiser.
The All About Cookies editorial team strives to provide accurate, in-depth information and reviews to help you, our reader, make online privacy decisions with confidence. Here's what you can expect from us:
You see an ad for a website offering free streaming services, and your eyes light up instantly. This one website could save you hundreds of dollars in subscription fees while still giving you access to the most premium and latest content. Only, the website isn’t what it looks like.
Researchers have found a new malware called StreamRat that promises free streaming but can infect your Android device and steal sensitive information from it.[1] It can also capture a screenshot of your device around five times a second, allowing attackers to see what’s happening on your screen and remotely control your device.
They could open apps, type in your login IDs and passwords, and even draw your PIN patterns, potentially carrying out financial fraud, identity theft, and targeted phishing attacks.
Here’s everything you should know about this new streaming scam and how to protect your Android device from malware.
The attackers first set up a website and ran ads on the Meta platform and TikTok, advertising a free TV streaming service. As researchers found, one ad campaign reached about 570,000 Meta users between June 11 and July 3, 2026.
When someone clicks on the ad, the website first uses JavaScript to check whether the potential victim is using an Android device. If Android is not detected, the user doesn’t see the download button at all.
Once Android users click on the download button, the site redirects to a second page (r1edmi.html). This page shows step-by-step installation instructions, usually requiring the victim to allow downloads from unknown sources and grant Accessibility Service permissions.
The Accessibility settings within Android allow people with disabilities to use their devices, but it’s exactly what the malware needs to take control of the device later. This is the similar to how the RatHat malware works, another Android malware that can steal your banking passwords by tracking your fingers.
The r1edmi.html page also downloads a file called app.apk. This isn’t StreamRat itself, but a dropper whose job is to prepare your Android device for installing StreamRat.
From here on, StreamRat takes over.
As per the published report, once your device has been infected with StreamRat, attackers could gain near-complete control of your device remotely.
As soon as StreamRat connects to the attacker's server, it starts sending data from the victim's device, starting with an extensive list of installed apps. This allows attackers to identify which apps are being used on the device.
StreamRat can also log what the victim types and keep track of which app is in the foreground. Every time the victim switches to a different app, the malware can report the app package name to the server, so the attacker knows which app the victim is using.
StreamRat can also capture screen lock patterns or PINs, potentially allowing the attacker to get into the victim’s phone even when it’s locked.
This is perhaps the most dangerous consequence of StreamRat. The malware uses three different ways to see what’s going on on the victim’s screen.
An attacker could use a victim’s phone as if it were their own. They can tap anywhere on the screen, swipe between two points, and interact with the device remotely through Accessibility Services.
Attackers may also type by pasting text into a field, giving them another way to interact with apps on the victim’s device. This could potentially allow them to enter sensitive information or perform actions inside banking and other apps.
StreamRat attackers could also use fake screens placed on top of real apps, called overlays, to trick the victim into giving away their credentials. For instance, when you open your banking app, StreamRat can show you a fake overlay mimicking your banking app’s interface.
You may enter your user ID, password, and two-factor authentication details on the screen, trusting it to be the legitimate app. The fake overlay can pass whatever information the victim enters back to the malware, hiding the attack from the victim, much like a phishing page.
All of this can happen without the victim immediately noticing anything wrong. StreamRat could hide the attack by using cover screens controlled from the attacker panel’s maintenance section. This black overlay could cover about 98% of the screen and block the victim’s touches. What the victim sees is essentially a black or fake update screen, while the attacker can continue to control the device remotely.
There are several things you can do to protect your Android device from StreamRat.
If you believe that your phone has already been infected by StreamRat, immediately cut off the attacker’s access by turning on airplane mode, which can help stop the malware from communicating with the attacker’s server.
Then go to Settings and Accessibility and switch off any services that you don’t recognize, and then uninstall the suspicious app, including both the streaming app and anything that appeared after it.
After this, change all your banking passwords. Make sure you set a strong, unique password each time, as well as changing your email and social media passwords and setting a new phone PIN or pattern. You can both change and store your passwords easily using a password manager.
A factory reset may also be worth considering if you want to thoroughly clean your device of malware. You could also consider an identity theft protection service that scans known data breach databases and the dark web for your information and alerts you if it finds it.
StreamRat advertises free streaming services, but once inside your system, it could allow attackers to use your phone as if it were their own. They can steal login details, read text on your screen, capture banking credentials, hijack login sessions, and even capture your phone’s PIN or pattern.
That said, you can largely avoid this type of malware attack with good cyber hygiene. Do not fall for the promise of free streaming and download apps from third-party sources, and pay close attention to the kind of permissions a newly installed app asks for. A streaming app shouldn’t need Accessibility access or a VPN connection.
An antivirus that scores 18/18 on AV-TEST for Windows and macOS, with top marks across all test categories
Passed every malware and drive-by download test we ran, quarantining threats automatically
Includes a junk cleaner, app uninstaller, and browser cleaner to keep your device running smoothly alongside the antivirus
/images/2023/08/04/total-av-vs-norton.png)
/images/2023/08/30/norton-360-deluxe-vs-premium.png)
/images/2026/09/24/streamrat-free-streaming-android-malware.png)
/images/2026/09/22/hackers-track-finger-movements-steal-banking-passwords-rathat.jpeg)
/images/2026/09/15/closeup_of_subcribe_to_mrbeast_on_smartphone.jpg)
/images/2026/08/27/wordlistloader-malware-plain-english.jpeg)
/images/2026/08/26/children_hands_holding_apple_ipad_with_multiplayer_online_game_minecra_dQXyfjY.jpg)
/images/2026/07/15/crashstealer-mac-infostealer.jpg)
/authors/krishi_chowdhary_headshot.jpg){kind=small}
/authors/kalleigh-lane-new.jpg){kind=small}
/images/2022/09/22/logo-totalav.png){kind=logo}
/authors/krishi_chowdhary_headshot.jpg)