A malicious advertising campaign promoting a fake free TV-streaming service reached roughly 570,000 Meta users.

The researchers who discovered the campaign found that its streaming-themed ads were aimed at Spanish-speaking users, with most observed victims located in Spain. One Meta campaign ran from June 11 through July 3, 2026, and the same banners were also used to distribute the malware through TikTok.

The available data shows the ads’ reach, not the number of downloads or infections, but it demonstrates how quickly paid advertising can put a scam in front of a very large audience.

The ads promoted an Android banking Trojan and infostealer called StreamRat. It can monitor what’s on screen, capture information typed into apps, show convincing fake screens to steal usernames and passwords, and allow attackers to control the device remotely.

We often warn people not to click suspicious links in unexpected texts or emails. But malicious advertising is harder to recognize because it appears in the same feeds where people expect to find promotions, videos, and recommendations.

This campaign is a perfect demonstration of why “after-the-fact” ad checks are inadequate when it comes to protecting social media users. Attackers used familiar social media advertising and carefully tailored instructions to turn casual interest in free entertainment into a risky app installation.

How the attack worked

The ad led victims to a website posing as a streaming platform. The site checked whether a visitor was using Android. Non-Android visitors were simply prevented from downloading anything, while Android users were shown an app download option. This is a common way for scammers to concentrate their efforts on devices their malware can infect.

The site also identified whether someone had arrived through Instagram, TikTok, Facebook, or a regular browser. It then displayed instructions suited to that situation, including steps to allow the browser to install apps from “unknown sources.” In other words, this was not a generic malicious download page: It was designed to coach people through the security warnings that would normally make them stop and think.

StreamRat is an Android banking Trojan and infostealer. It can monitor what’s on screen, capture information typed into apps, show convincing fake screens to collect usernames and passwords, and enable attackers to operate the device remotely. The researchers also found options to cover the screen with a black page or fake Android update screen. These can distract victims while criminals interact with the phone behind the scenes.

How to stay safe

While this campaign targeted Spanish-speaking people, primarily in Spain, the following guidelines can help anyone avoid similar attacks.

• Avoid installing Android apps from ads, direct-download websites, social media messages, sponsored search results, or links sent by strangers.
• Download apps through Google Play whenever possible, and check the developer’s name, reviews, and app history rather than relying on an ad.
• Before enabling installation from “unknown sources,” read our guide, Sideloading on Android: What it is, why it’s risky, and how to do it more safely.
• Be very cautious when an app asks for Accessibility access, screen-sharing permission, Device Admin privileges, or permission to become the default launcher. Permissions that don’t line up with the intended use of the app are very suspicious.
• Use an up-to-date, real-time anti-malware solution on all your devices.

What to do if you installed a suspicious app

If you installed a suspicious APK and granted it Accessibility access, disconnect the phone from Wi-Fi and mobile data. If possible, revoke the app’s Accessibility access and remove it. Use another device to change relevant passwords and contact your bank if you used banking apps on the infected phone. A factory reset may be necessary if you cannot confidently remove the infection.

Malwarebytes for Android detects the components of StreamRat as Android/Trojan.Agent.ACRAEEF8A36H36, Android/Trojan.Agent.ACR02DB0614H7, and Android/Trojan.Dropper.ACR9B7ECE83D1.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

Last week on Malwarebytes Labs:

• Zombie Card: An expired Visa credit card can be used for purchases
• Medical records, SSNs, and bank details exposed in CareCloud data breach
• ChatGPT for Teens tackles risky chats and homework shortcuts
• Twitch wants your content for Amazon AI training. Here’s how to opt out
• Your Mac already has a built-in firewall. Here’s how to get more from it
• 9 million images of people’s faces exposed by reverse lookup service
• 41 deceptive download sites show a real link, then send you somewhere else
• Sideloading on Android: What it is, why it’s risky, and how to do it more safely
• Scammers are using fake crypto AML checkers to drain your wallet
• Update Chrome now: Two critical vulnerabilities fixed
• Your polite reply to that text is worth $2 on the dark web
• Apple fixes another image-processing flaw that could allow code execution
• Be careful what you put in “anyone with the link” Google Docs
• Heights Finance data breach: What customers need to know
• ShieldBreak bypasses Microsoft’s patch for earlier Defender flaw
• Fake TikTok rewards promise cash you’ll never get
• Update your Mac: Screen Sharing vulnerability exploited in the wild
• Why Facebook’s war on ad blockers could help scammers

Stay safe!

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

TikTok-branded “rewards” pages are promising users cash for checking in every day, completing small tasks, and earning points. Those points supposedly convert into real money, and the balances look enormous. A countdown timer usually warns that your balance is about to expire. But when you try to withdraw it, there’s always something else you need to do first.

If you just want the short version

TikTok does have a legitimate Creator Rewards Program, but it doesn’t work like the sites we’re talking about here. Creator Rewards is for eligible creators in certain countries who meet specific requirements. They earn rewards for eligible original videos, not for checking in every day or completing tasks on a separate rewards website.

If you find a TikTok-branded site offering large cash rewards for check-ins, referrals, or simple tasks, don’t assume it’s legitimate just because TikTok has its own rewards program.

You can end up chasing a payout that was never coming, handing over personal or banking details, or installing an unwanted app.

How these pages typically work

Most versions of this scam are built to look like a mobile shopping or loyalty app. There’s a TikTok logo, a “welcome back” greeting, a daily check-in tracker, and tabs for tasks, referrals, and your profile. At first glance, it can easily look like an official rewards program connected to TikTok.

When you tap through to the “redeem” screen, the numbers can show a cash balance in the thousands, converted from a huge pile of points, along with a countdown warning that your balance is about to expire. The minimum withdrawal is usually low enough to make cashing out look easy.

It isn’t.

Sites like this tend to introduce one more requirement every time you get close to actually withdrawing the cash. Refer more friends, watch more videos, complete a sponsored offer through an affiliate network, or download a separate app to “verify” your identity.

The app download may be the real goal, particularly if the operator gets paid for generating installs. The app could also be adware or other unwanted software.

Big numbers don’t mean real money

Nothing on these pages reflects a real ledger. A balance on the screen doesn’t mean there’s money waiting for you.

On a fake rewards site, the points, cash balance, and countdown can simply be numbers generated by the site itself, with no connection to TikTok’s actual systems.

The operator simply invents a sum that feels too good to walk away from.

So who is making money?

These sites tend to make money the same way most ad-funnel scams do: through affiliate and CPA (cost-per-action) programs.

CPA means the site operator can get paid when you do something, such as clicking an ad, signing up for a service, or installing an app. So even if you never receive the promised reward, your clicks, sign-ups, and downloads can still make money for someone else.

Why it’s easy to get pulled in

A daily check-in streak creates a small sense of investment. Walking away means giving up your streak and the money you think you’ve already earned.

Then there’s the big balance sitting on the screen and a countdown telling you it’ll disappear if you don’t act soon. Together, they give you plenty of reasons to keep going and very little time to question whether any of it is real.

What to do if you find one

• Don’t enter banking details, card numbers, or ID information unless you’ve confirmed you’re using an official TikTok service.
• If you were prompted to download an app outside TikTok itself, don’t install it. If you already have, uninstall it and run a security scan on your device.
• Don’t refer friends or family to keep a streak going or unlock a withdrawal. You’d just be pulling them into the same funnel.
• Check rewards in TikTok itself. TikTok’s Creator Rewards Program is for eligible creators and is managed through TikTok. If a separate website claims you can earn TikTok cash rewards through check-ins or simple tasks, don’t assume it’s part of the same program.

Reward-mill scams like this aren’t unique to TikTok. The same check-in-and-cash-out formula appears with other brand names too. The name may change, but the trick is much the same: Keep you clicking with the promise that your money is just one more task away.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Last week on Malwarebytes Labs:

• AI chat bots are sliding into League of Legends friend requests
• Meta ordered to pay $942 million over harm to children
• Apple WebKit vulnerabilities reveal your IP address, despite Private Relay
• Scammers target OnlyFans users with deepfakes
• Amazon and Apple impersonated in “$149.99 unauthorized charge” scam
• Anthropic’s Mythos AI used social engineering to target real people
• Google’s synchronized passkeys can be stolen in “Pass‑ta‑key” attacks
• Junk Cleaner clears the clutter from your Android
• Apple battles it out again with the UK over encrypted iCloud access
• Travelers targeted when logging into hotel Wi-Fi networks
• Online backlash ends in Google rolling back Google Earth AI tool after a day
• WhatsApp account takeover scam asks you to “vote for my friend”
• “Adult TikTok” searches lead to scams
• The AI Act kicks into action, forces companies to be clear about AI chatbots
• Californians can tell data brokers to DROP their information

Stay safe!

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Last week on Malwarebytes Labs:

• Fake Fortnite rewards are stealing players’ accounts
• Fake Flash Player installs AtlasRAT
• Malwarebytes for Windows, now available on the Microsoft Store
• Hims & Hers sued over alleged health data privacy failures
• Hidden prompt turns Microsoft Copilot into an AI worm
• Apple accused of letting fake crypto app steal $1.8 million
• Buying TikTok views or followers? Here’s what you’re really getting
• AI robocalls: Why caller ID is still lying to you
• OpenAI explains how its AI agent breached Hugging Face
• We found 120 fake Walmart stores trying to steal your credit card
• We rebuilt Malwarebytes Mobile Security for the scams of today
• Shared Claude chats were searchable on Google
• Update your iPhone, iPad and Mac to fix Apple security holes
• Vatican’s Click To Pray app exposed personal data from 700,000 users
• Aftercall ads are driving Android users crazy
• Sextortion scammers are exploiting ShinyHunters data leaks
• What’s your data worth on the dark web? (Lock and Code S07E15)

Stay safe!

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

Resin art has become a popular corner of TikTok, with some videos attracting millions of views. But not every glossy, colorful post is what it claims to be. Scammers are using the look of handmade resin art to trick buyers, collectors, and even fellow artists into sending money for work that either doesn’t exist or wasn’t created by the person posting it.

There are plenty of genuine resin artists on TikTok. Unfortunately, the platform has also attracted scammers who steal videos and impersonate legitimate creators.

The scam is fairly straightforward. A TikTok account presents itself as a resin artist, posts satisfying videos, and invites people to “DM to order.” In some cases, the videos are stolen from other creators, the account has no real process footage, and the seller disappears after receiving payment.

One resin artist discovered that scammers were using their videos to impersonate them and scam TikTok users. They shared the following comment:

Ridiculous TikTok scammer…lol. Profile says they’re a resin artist and to DM them to order, but none of the videos are theirs. When I wrote to them asking them to take down the many videos of mine that they posted, passing them off as their own with no credit, their answer was that they aren’t a resin artist and are just sharing videos they like Literally about 1/4 of “their” videos are mine

These scams often rely on trust and urgency. The account may show polished clips of poured resin, finished coasters, trays, jewelry, or wall art, then push buyers to move the conversation into direct messages. Once the buyer moves to a different platform, the scammer typically requests a deposit, full payment, or personal details with little chance of being held accountable.

And real artists don’t just get their work ripped off. A scammer may contact a creator claiming to want to buy, feature, or license their work, but the real goal is to extract fees, banking information, or other sensitive data. Social media art scams are often repetitive because they are built from the same templates and scripts.

How to spot a TikTok resin art scam

The safest approach is the boring one: verify before you pay. If the artwork looks amazing but the seller’s identity is vague, the risk is real.

Check the TikTok account

Before ordering, look for signs that the artist is genuine:

• The account didn’t appear overnight and has a history of original posts.
• The same videos don’t appear under multiple creator names or belong to another artist.
• The creator shows themselves making the artwork, with consistent process videos, a recognizable workspace, and works in progress.
• The videos don’t contain obvious AI artifacts, such as impossible resin effects or objects moving after they’ve supposedly been sealed inside hardened resin.
• Comments raising concerns haven’t been deleted or buried under generic praise.
• The seller isn’t pushing you to order only through direct messages or asking for payment before you’ve verified who they are.

Check the website

If you do click through to a website, spend a few minutes checking it before you buy:

• Look for a genuine returns and refunds policy, a physical business address, company or VAT details (where applicable), and consistent contact information.
• Check how old the website is. Scam sites often use domains that were registered only weeks or months ago, especially when they claim to have been selling handmade products for years.
• Search for recent independent reviews rather than relying on testimonials published on the site itself.
• Run a reverse image search on the product photos to see whether they’ve been copied from another artist.
• Only pay using a method that offers buyer protection, such as a credit card or PayPal. If a seller insists on a bank transfer, cryptocurrency, or another irreversible payment method, walk away.

Not every resin art account is a scam. Many belong to genuine artists, and that’s why impersonation scams can be so convincing.

If you’re unsure, paste the website address into Malwarebytes Scam Guard and ask whether it shows signs of being fraudulent. It can help identify suspiciously new domains and other common scam indicators.

Use real-time web protection to block known fraudulent and malicious websites, like Browser Guard did for this web shop:

Both are free—making them much cheaper than sending money to a scammer.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free →