A newly uncovered Android banking trojan dubbed RemControl is targeting customers of more than 30 financial institutions across Europe, the Middle East, and Canada.
The malware combines fake Google Play pages, Android Accessibility Service abuse, credential-stealing overlays, real-time screen streaming, and remote-control functions to compromise mobile banking sessions.
The company tracks the operator behind the earliest campaigns as UNKK, based on hardcoded affiliate and campaign identifiers recovered from analyzed samples.
The campaign begins with fake Google Play Store pages impersonating TVTap, a third-party IPTV application commonly sought from unofficial download sites.
The malicious pages are designed to appear legitimate and, in at least one Italy-focused operation, checked visitors’ IP geolocation and mobile User-Agent before delivering the APK.
Researchers also identified Meta Pixel tracking IDs on the pages, indicating that malvertising likely drove victims to the fraudulent downloads.
After installation, the RemControl dropper presents a WebView-based interface disguised as a TVTap update prompt.
It then abuses Android’s VPN functionality to block network traffic associated with com.android.vending, the Google Play Store package.
This effectively interferes with Google Play Protect connectivity during installation, limiting real-time scanning at a critical stage of the attack.
The dropper also generates a fresh signing certificate for every installation using Android Keystore functionality. As a result, each payload carries a different certificate and hash, complicating conventional hash- and certificate-based detection.
Newer variants further protect their code with a custom DEX packer that derives its decryption key from the APK signing certificate, binding the protected payload to an individual build.
Once the victim grants Accessibility Service permissions, RemControl gains the capabilities needed to hijack banking activity.
Group-IB researchers said that, RemControl operates as a Malware-as-a-Service platform and has been active since at least May 2026, while the first identified samples appeared in July.
RemControl Android Malware
The malware monitors foreground applications and fetches a dynamic target list from its command-and-control infrastructure.
The strings in both the dropper and payload are obfuscated by Base64 encoding followed by XOR decryption against a hardcoded key, thus hiding the strings from simple string inspection.
When a targeted banking app opens, RemControl places a full-screen WebView overlay over the legitimate application, collecting data such as PINs, banking codes, card-expiry dates, and other login credentials.
The overlay content is not embedded in the APK. Instead, it is retrieved dynamically from the C2 server, enabling operators to change phishing templates or retarget infected devices without requiring a new malware installation.
Group-IB confirmed overlays targeting banks in Italy, France, Spain, Poland, Portugal, Canada, and Gulf Cooperation Council member states, with Italy and France appearing to be major initial targets.
The malware fetches one of two hardcoded Telegram channel URLs in round-robin. It then searches the page HTML for a marker string appearing twice, extracts the content between the two occurrences, Base64-URL decodes it, and decrypts it with AES-128-CBC.
RemControl extends beyond overlay fraud. It can capture device screenshots through AccessibilityService.takeScreenshot(), encode them as WEBP images, and stream them over WebSocket connections.
It also transmits the Android accessibility tree as structured JSON, exposing visible text, UI elements, coordinates, and interaction states.
This gives operators both a visual and machine-readable representation of a victim’s device.
The malware can additionally log clicks, text changes, focus events, and selections across applications. Its remote-control toolkit supports taps, long presses, swipes, scrolling, gesture actions, and direct text injection.
Researchers also found functions that identify pattern-lock interfaces on major Android implementations, including Samsung One UI, Xiaomi MIUI, Huawei, OPPO ColorOS, OnePlus, and stock Android variants.
For C2 resilience, RemControl uses Telegram as a dead-drop resolver.
A notable operational mistake linked the campaign to AI-assisted development: researchers found a complete AI assistant response accidentally appended to a live banking-phishing overlay.
The malware retrieves encrypted configuration data from hardcoded Telegram channels, decodes the concealed C2 address, and then communicates primarily over WebSocket, with HTTP POST as a fallback.
This architecture allows operators to rotate infrastructure without recompiling the malware.
Group-IB also found publicly exposed API documentation for infrastructure labeled “RemControl Proxy” and the operator panel.
The panel exposed bot management, overlay editing, credential-result viewing, macro automation, VNC session replay, and per-affiliate APK build capabilities, reinforcing the assessment that RemControl is a MaaS operation.
Russian-language comments in overlay code provide a limited clue about the developer’s language background, while campaign-tag overlaps and delivery similarities suggest a possible connection to the Medusa UNKN affiliate ecosystem.
IOCs
| IOC | Description |
| hxxps[:]//tvtap-hd[.]app/ | Distribution – fake TVTAP download website |
| hxxp[:]//vpn[.]doneplay[.]site/ | Distribution – fake TVTAP download website |
| hxxp[:]//ff-de[.]shutgpt[.]ir/ | Distribution – fake TVTAP download website |
| hxxp[:]//vpn[.]askarzadeh[.]com/ | Distribution – fake TVTAP download website |
| hxxp[:]//cdn[.]dlmafi[.]top/ | Distribution – fake TVTAP download website |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
