Group-IB uncovers RemControl, a new Android banking trojan targeting European, Middle Eastern and Canadian banks, whose criminal infrastructure was unknowingly built by AI.

running real-time scans against known malware read more about New RemControl Android banking malware targets users in Europe and Canada

A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application.

Malware RemControl puede controlar celulares Android, mostrar falsas pantallas bancarias y robar credenciales. Así funciona y cómo evitarlo.

Un nuevo malware para Android se disfraza de aplicaciones de TV. Roba credenciales bancarias mediante interfaces engañosas.

A newly uncovered Android banking trojan dubbed RemControl is targeting customers of more than 30 financial institutions across Europe, the Middle East, and Canada.

A new Android malware named RemControl is targeting banking customers across Europe, the Middle East, and Canada by abusing Accessibility Services and AI-generated code.

A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application. [...]

✓ AI Security Awareness Training lessons from RemControl, an Android banking malware campaign targeting Europe and Canada through fake apps and phishing overlays.

A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application.

Onderzoekers van Group-IB hebben een nieuwe Android-bankentroyan geïdentificeerd, genaamd RemControl. De eerste sporen van deze malafide software werden in juli 2026 ontdekt. RemControl maakt gebruik van misleidende downloadpagina's die de uitstraling hebben van de Google Play Store, maar de aangeboden streaming-app is daar niet verkrijgbaar. Deze valse pagina's worden gehost op servers die door de aanvallers worden beheerd. Een specifieke campagne richtte zich uitsluitend op gebruikers met Italiaanse IP-adressen, waarbij de malafide installer alleen werd aangeboden aan deze groep. Na installatie presenteert de troyan eerst een nagemaakte update-scherm voor de streaming-app. Vervolgens vraa...

A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application.

RemControl, a new Android banking trojan, spreads through a fake TVTap app, blocks Play Protect and steals PINs from bank customers.

A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application.

A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application.

Notamment en Europe, les clients d'une trentaine d'institutions financières sont des victimes potentielles du malware pour Android baptisé RemControl. Il porte les traces d'un développement assisté par IA.

RemControl, a new Android banking trojan, spreads through a fake TVTap app, blocks Play Protect and steals PINs from bank customers.

RemControl is a new Android banking trojan that lures victims with fake TVTap app pages, then abuses permissions to take over devices and steal banking PINs and other sensitive data. Group-IB found that it targets customers of more than 30 banks across several countries and appears to use AI-assisted infrastructure and malware-as-a-service delivery. #RemControl #GroupIB #TVTap #UNKK #UNKN #Medusa

A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application.

## 1. Basic Information * Original Title: RemControl: AI Built the Overlays. Victims Lose their PINs * Published Date: 2026-09-23 * Updated Date: None * Collection Date: 2026-09-24T08:09:37+09:00 * Source: Group-IB * Severity: high * Type: Threat Intelligence * Target Period: 2026-09-23T08:14:06+09:00 to 2026-09-24T08:09:37+09:00 (Asia/Tokyo) * Original Link: RemControl: AI Built the Overlays. Victims Lose their PINs * Related Sources: BleepingComputer: New RemControl Android banking malware targets users in Europe and Canada * Severity Rationale: It is a MaaS targeting over 30 financial and cryptocurrency services, with Observed campaigns target financial institutions in Europe, the Middle East, and Canada, with Italy and France identified as the main targets. It blocks Play Protect traffic on the device and features remote control, PIN theft, and uninstall prevention. * Reason for Update: Corrected the order of VPN, payload deployment, and Accessibility permission, the confidence level of malvertising, and the basis for AI assistance. Attribution evaluations were moved to sourced Facts and mapped to ATT&CK Mobile. ## 2. Executive Summary RemControl uses phishing overlays and Android Accessibility services to steal banking credentials and gain remote control of devices. Its dropper uses a local VPN to disrupt Play Protect checks. ## 3. Attack Flow ### Fake TV App Installation and Privilege Acquisition 1. A fake Google Play page mimicking TVTap filters visitors by IP geolocation and User-Agent to distribute the APK. Based on the presence of Meta Pixel, Group-IB infers the use of malvertising. 2. When the user installs the dropper, a fake update screen prompts them to use a local VPN. The VPN blocks traffic from the Google Play Store app, preventing Play Protect checks during installation. 3. The dropper generates a signing key for each installation, signs the RemControl payload, and deploys and launches it via PackageInstaller. 4. The payload asks the user for Accessibility Service permission. Once granted, it can use features like screen monitoring and remote control. ### Post-Installation Communication, Theft, and Remote Control Features 1. It retrieves the C2 connection destination from encrypted data on Telegram, communicating via WebSocket as the primary channel and HTTP as a backup. 2. When the foreground app matches a target list received from the C2, it displays a fake banking screen to collect input data. 3. Features include screen and UI tree monitoring, remote gestures, text input, keylogging, lock info retrieval, and prevention of settings screens or uninstallation. This does not mean all features are executed for every victim. ## 4. Attacker Location and Execution Environment * Operators of malvertising or fake distribution sites * Remote operators communicating with Android devices via WebSocket/HTTP C2 * Parties capable of updating dead drop information on Telegram ## 5. Visibility for Victims and Administrators ### Victims * Screens prompting the installation of a TV streaming app and Accessibility permissions * Realistic login screens overlaying banking apps * Behavior where the settings screen cannot be opened or the app cannot be uninstalled ### Administrators and SOCs * Low visibility on unmanaged devices * In MDM/EDR environments, clues include APKs signed with unrecognized certificates, granted Accessibility privileges, created VPN profiles, and persistent WebSocket traffic ## 6. Success and Failure Conditions ### Success Conditions * The victim installs an out-of-store APK * Permissions such as Accessibility, screen display, and VPN are granted * The device can communicate with the C2 or dead drop destination * An overlay corresponding to the target app exists ### Failure Conditions and Mitigations * Block app installations from unknown sources * Limit Accessibility permissions only to apps required for business * Block unauthorized apps and APKs signed with unrecognized certificates via MDM * Block known malicious distribution and C2 destinations, and investigate unauthorized WebSocket connections. ## 7. What Happens Upon Success * Theft of credentials, PINs, and input data for banking and cryptocurrency services * Continuous monitoring of the device screen and UI structure * Remote control by attackers and support for unauthorized transfers * Interference with protective functions and prevention of removal ## 8. Observable Logs ### Email * Email vectors have not been confirmed in primary sources ### Proxy / SWG / DNS * DNS/HTTP traffic to tvtap-hd[.]app, tvtap-liveapp[.]com, bnbnhura[.]top, etc. * Long-duration WebSocket connections from Android devices to unknown hosts * Timeline showing connection to a new C2 immediately following Telegram-related traffic ### Endpoint / EDR * Installation of APKs signed with unrecognized certificates * Accessibility service registration and privilege assignment * Creation of local VPN profiles * Screen overlays, suppression of settings screens, and PackageInstaller calls ### Identity / IdP * Potential device changes, anomalous IPs, and additional authentication failures in banking and cryptocurrency services ### SaaS / Cloud * Where available, review MDM and mobile threat defense telemetry for unauthorized app installations, VPN configurations, and Accessibility settings. ### Network * Periodic traffic to WebSocket/HTTP C2 * Unusual failures in Play Protect-related traffic ## 9. Attack Success Determination ### Confirmed via Public Information * **Confirmed Sample Features and Operating Infrastructure** : Group-IB analyzed sample installation and behavior, active distribution/C2 infrastructure, and overlays for over 30 targets. This confirmation cannot be generalized to successful credential theft or unauthorized transfers for individual victims. Scope: Group-IB sample and infrastructure analysis. The number of infected devices and the extent of financial losses have not been disclosed. ## 10. Investigation Playbook ### Trigger * Any of the following: unknown APK, granted Accessibility, unauthorized VPN, or target IoC communication ### Initial Verification * Save the APK hash, signing certificate, and source * Record permissions, Device Admin, Accessibility, and VPN settings * Correlate C2 connection time with banking app usage time ### Device and Server * Check installed packages, overlay permissions, running services, and WebSocket connections * Distinguish between access permissions to screen/input data and actual evidence of theft to identify potentially exposed information ### Authentication and Cloud * Check banking, cryptocurrency, and email sessions and MFA registrations * Change credentials from a non-compromised device and invalidate existing sessions ### Subsequent Operations * Check for unauthorized transfers, wallet withdrawals, suppression of SMS/notifications, and abuse of contacts ### Containment * Isolate the device from the network and preserve APK, permissions, and communication logs. Since factory resets wipe device data, decide after securing evidence and necessary business data. * Block distribution and C2 domains, and restrict unknown APKs and Accessibility via MDM ### Judgment Classification * Separately substantiate connection to distribution sources, payload execution and privilege assignment, transmission of credentials, and remote unauthorized operations ## 11. Defense and Detection Ideas ### Single Event * Event where an unauthorized APK registers an Accessibility service * Creation of a VPN profile by an unknown app ### Timeline Correlation * Verify the timeline of dropper installation -> local VPN startup -> deployment of re-signed payload -> Accessibility permission -> C2 communication ### Hunting * In addition to IoCs, hunt for APKs masquerading as TV streaming, certificates that differ per installation, and long-duration WebSockets ### Log Gaps * APKs, permissions, and VPN changes are often not collected in BYOD environments ### Priority Measures * Prohibit out-of-store apps * Control Accessibility permissions * Mobile threat defense and risk-based authentication for financial accounts ## 12. Facts / Inference / Hypothesis ### Facts * Group-IB reported RemControl as an Android banking Trojan MaaS identified since July 2026. * Fake distribution pages masquerading as TVTap filter visitors by IP geolocation and User-Agent. Group-IB points to the possibility of malvertising abusing Meta ads, based on Meta Pixel. * RemControl abuses Android Accessibility to transfer screen/UI trees, perform remote gestures, input text, log keys, and display overlays. * Local VPNs on the device block Google Play Protect-related traffic, and different signing certificates are used for each installation. * Overlays for over 30 banking and cryptocurrency services have been confirmed, targeting financial institutions in Europe, the Middle East, and Canada, with Italy and France identified as the main targets. * C2 uses WebSocket as the primary channel and HTTP as the backup, resolving connection destinations from encrypted data on Telegram. * Group-IB assesses that AI assistance was used to develop the C2 infrastructure and fake screens, noting that the full response of an AI assistant remained inside the distributed overlay HTML. * The affiliate tag across all analyzed samples was UNKK. Group-IB pointed out similarities with Medusa's UNKN but did not make a definitive attribution to the same operator. ### Inference * Per-installation signing certificates and multi-stage communication destination resolution shorten the lifespan of detections relying solely on static IoCs. * Droppers supporting over 30 languages and dynamic target lists enable regional expansion, though no activity targeting Japan has been confirmed. ### Hypothesis No additional hypotheses. Unconfirmed items are listed in "Unknowns and Further Investigation". ## 13. MITRE ATT&CK Mapping ID | Technique | Confidence | Rationale ---|---|---|--- T1417.002 | Input Capture: GUI Input Capture | high | ATT&CK Mobile. Functionality to capture input data by overlaying fake screens on banking apps. T1437.001 | Application Layer Protocol: Web Protocols | high | ATT&CK Mobile. C2 communication via WebSocket and HTTP. ## 14. Unknowns and Further Investigation * Number of infected devices and total financial loss * Relationship between UNKK and known Android malware operators * Presence of overlays targeted at Japan * Update frequency of dead drop information and C2 ## 15. Impact on SOCs and Organizations Although targeting of users in Japan has not been confirmed, organizations allowing Android BYOD should correlate telemetry for out-of-store APKs, Accessibility, and unauthorized VPNs. Financial and cryptocurrency-related enterprises should assume credential compromise originating from customer devices and combine device risk with transaction anomalies. ## 16. Target-Specific Summary ### SOC Correlate unknown APKs, Accessibility, VPN creation, and WebSocket traffic in a timeline, and track authentication anomalies following credential theft. ### Administrators Prohibit out-of-store APKs and unnecessary Accessibility, and control unauthorized VPNs via MDM. ### General Users Do not install unofficial TV streaming APKs via ads, and carefully verify permission requests for Accessibility and VPNs.