Researchers at Group-IB have documented RemControl, a previously unknown Android banking trojan aimed at retail banking customers in Western Europe, the Middle East and Canada. According to the cybersecurity firm, the malware is spread through fake Google Play Store pages impersonating the TVTap IPTV app, with malvertising campaigns that abuse Meta's advertising platform confirmed as one of the ways victims are lured in.
What it does. Once installed, RemControl abuses Android's Accessibility Service to place fake login screens, known as overlays, on top of legitimate banking apps. It can also stream the device screen in real time, log keystrokes and give the operator full remote control of the phone. Group-IB counts more than 30 confirmed overlay targets covering banking apps in Italy, France, Spain, Poland, Portugal, Canada and some Gulf Cooperation Council states.
A tempting lure. TVTap is a popular third-party IPTV app that is not available on Google Play, so users are used to downloading it from unofficial sources. In one campaign apparently aimed at Italian users, Group-IB found six distribution URLs with pages in Italian that only served the malicious file to mobile devices with an Italian IP address. The pages embedded Meta Pixel tracking code, which suggests the operator was paying for ads to drive traffic.
Silencing Play Protect. The dropper asks for permission to create a local VPN and uses it to cut Google Play Store traffic off from the network, preventing Google Play Protect from scanning the installation in real time. It then signs each payload with a freshly generated certificate, so no two installations look the same, defeating hash and certificate-based detection. The dropper supports over 30 languages, hinting at possible expansion to new countries.
AI left its fingerprints
An exposed panel. The operator's control panel API documentation was inadvertently exposed during the analysis, revealing a build system and affiliate tracking typical of a Malware-as-a-Service platform. Group-IB says both the panel documentation and the phishing overlays show artifacts of AI-assisted development, including a complete AI assistant response left verbatim in a live phishing page shown to banking victims. Russian-language code comments were also found in several overlay files.
Who is behind it. The first campaigns are attributed to an actor tracked as UNKK, identified through hardcoded affiliate and campaign tags. Group-IB also points to a possible link with the Medusa UNKN affiliate botnet, based on similar naming conventions, delivery methods and the use of encrypted Telegram dead-drops to locate command servers. Samples date back to July 2026, with infrastructure active since May.
- Avoid installing apps from links in ads or unofficial download pages, especially IPTV and streaming apps.
- Be wary of any app that asks for Accessibility Service permissions without a clear reason.
- Do not grant permissions to create a VPN to apps that are not VPN services.
- If your banking app login looks unusual right after installing something new, contact your bank.
Source: Group-IB
Leave a Reply