RemControl Android Banking Malware Targets Users in Europe, Canada and the Middle East

A new Android malware-as-a-service (MaaS) platform named RemControl is targeting users through a malvertising campaign that impersonates the TVTap IPTV application.

Researchers at cybersecurity firm Group-IB say RemControl has targeted users in Europe—including Italy, France, Spain, Poland and Portugal—as well as Canada and countries in the Middle East.

The malware infrastructure has been active since at least May. The first known sample was observed in July and contained more than 30 phishing overlays designed to steal banking credentials.

One overlay displays a response generated by an AI assistant, strongly indicating that an AI model may have been used to help build the malware.

RemControl spreads through fake Google Play pages

RemControl is distributed through fake Google Play pages that masquerade as the TVTap IPTV app. At least one campaign targeting Italy uses geofencing and mobile user-agent checks to control who can access the malicious download page.

The malicious websites also contain Meta Pixel tracking IDs. According to Group-IB, this suggests the operators may have used Meta’s advertising ecosystem to direct victims to the fake download pages.

Malware attempts to bypass Google Play Protect

When the dropper launches, it starts a VPN service that blocks traffic from Google Play Services. This prevents Play Protect from carrying out real-time checks for known malware.

Researchers have also observed this functionality in the latest version of the ToxicPanda malware. ToxicPanda is part of a broader operation that uses phishing overlays against 349 financial, cryptocurrency and digital wallet applications across 16 countries.

RemControl abuses Android Accessibility Services

During installation, RemControl asks the user to approve access to Android Accessibility Services. Once the requested permissions are granted, the malware can:

• Display full-screen phishing overlays on top of legitimate banking apps to steal PINs, bank codes, card expiration dates and login credentials.
• Receive new banking targets dynamically from its command-and-control (C2) infrastructure.
• Stream screenshots and the complete Android accessibility and user-interface tree to operators in real time.
• Record clicks, text changes, focus events and other user input within applications.
• Tap, swipe, scroll, perform gestures, press and hold, and insert text remotely.
• Capture Android pattern-lock coordinates across multiple manufacturers, including Samsung, Xiaomi, Huawei, OPPO, OnePlus and standard Android devices.
• Detect when a victim opens app-management, Accessibility Services or factory-reset settings, then automatically close to prevent removal.

Encrypted C2 infrastructure uses Telegram

RemControl retrieves encrypted C2 information from Telegram channels, allowing its operators to rotate the malware’s infrastructure if a server becomes unavailable.

Group-IB also discovered FastAPI documentation published on the first C2 proxy. The documentation revealed an endpoint used by the malware to obtain banking overlays and send stolen credentials.

Researchers link RemControl to UNKK

The origins of the attackers behind RemControl remain unknown. However, Russian-language text found in the HTML files of some overlays suggests that at least some of the developers speak Russian.

Based on common identifiers found in the analyzed samples, researchers tracked the RemControl operator as UNKK and suspected an association with the Medusa banking Trojan.

How Android users can stay safe

Android users should avoid downloading APK files from sources other than Google Play unless they explicitly trust the publisher.

Users should also run regular Play Protect scans and deny Accessibility Services requests from apps that do not genuinely require accessibility access.

Join Mikko Hypponen and security leaders from the NFL, Chanel and Atlassian for a two-hour digital summit about what will change with AI-speed attacks, what defenders should stop doing, and how to verify, decide, fix and revalidate at machine speed.

Please reserve your seat