A new Android banking trojan called RemControl tricks victims into installing a fake TV app, then takes control of their phones to steal banking PINs, Group-IB has found.
Researchers confirmed that the malware targets customers of more than 30 banks in Italy, France, Spain, Poland, Portugal, Canada and some Gulf states. The first samples were submitted to VirusTotal on July 19, 2026. The domain used for its command and control (C2) server was registered on May 12, 2026, two months earlier.
“RemControl spreads through fake Google Play Store pages impersonating the TVTap IPTV application. TVTap is a popular third-party IPTV application that is not available on the Google Play Store, making users accustomed to seeking it from unofficial sources. This is why IPTV apps like this are among the most popular lures for Android malware distribution,” Group-IB wrote.
In one campaign aimed at Italian bank customers, six websites hosted these pages. They serve the malicious app only to mobile devices with an Italian IP address. The pages contain two Meta Pixel tracking codes, which suggests the operator is buying ads on Meta’s platform to bring victims to the download pages.
How RemControl takes over a phone
Once opened, the dropper shows a fake TVTap update screen. When the victim taps install, it asks for permission to start a VPN service. The VPN blocks network traffic from the Google Play Store app, which stops Google Play Protect from scanning the installation.
The dropper then creates a new signing certificate on the device and signs the malware with it before installing it. Each installation gets a different certificate, which defeats detection based on file hashes and certificates. Newer versions also encrypt the malware’s code with a custom packer.
The installed malware immediately asks the victim for Accessibility Service permission, which the researchers explained is abused by almost every Android banking trojan and gives RemControl control over the device.
The dropper asks the victim for permission to install other apps (Source:Group-IB)
With these permissions, RemControl can perform the following actions:
- Cover targeted banking apps with fake login screens to steal PINs, mobile banking codes and card expiry dates, with a target list the operator can change at any time.
- Send live screenshots to the attackers, along with a map of the text and position of every element on the screen.
- Record clicks and typed text in all apps, and allow remote tapping, swiping and typing on the phone.
- Capture the pattern grid on the lock screen, which is enough to reconstruct the unlock pattern on ten Android versions, including those used by Samsung, Xiaomi and Huawei.
- Prevent victims from removing the malware by redirecting them away from settings used to uninstall apps, revoke accessibility permissions or perform a factory reset.
The malware finds the address of its C2 server in encrypted text posted in two public Telegram channels. This lets the operator switch to a new server without releasing a new version of the malware.
Phishing pages written by AI
The documentation for the attackers’ server was publicly accessible during the investigation. It describes the functions that deliver fake banking screens and receive stolen credentials as handling quiz answers, and refers to parental monitoring.
“What makes this campaign particularly notable is the evidence of AI-assisted development throughout the infrastructure. The operator appears to have used an AI assistant to build significant portions of the C2 backend and phishing overlays under the guise of a parental monitoring application, with the AI unaware of what it was actually building,” researchers explained
The documentation also shows that RemControl is offered as malware-as-a-service.
Comments in Russian in some of the fake login screen files suggest that at least part of the code was written by a Russian speaker.
Group-IB tracks the operator as UNKK, after an affiliate tag found in every sample. The researchers see a possible link to UNKN, a Medusa banking trojan affiliate. Both use similar dropper names, the same delivery methods and Telegram channels to hide servers, and their tags differ by one letter.
“While these indicators are suggestive of a common operator, a definitive link cannot be established from available evidence,” Group-IB concluded.