The discovery of RemControl, a new Android banking malware-as-a-service platform, highlights how mobile banking malware is evolving from relatively simple credential-stealing tools into sophisticated remote-access platforms capable of controlling an infected device in real time.

According to research from Group-IB, the infrastructure behind RemControl has been active since at least May 2026, while the first malware samples were observed in July.

The campaign targets users primarily in:

  • Italy
  • France
  • Spain
  • Poland
  • Portugal
  • Canada
  • several Middle Eastern countries

The malware is distributed through malicious advertising campaigns that impersonate the TVTap IPTV application and direct users toward fake Google Play pages.

This is an important distinction.

Victims are not simply receiving a random APK file through an obviously suspicious message.

The attackers attempt to recreate the appearance of a legitimate mobile-app installation process, reducing the visual differences between the malicious site and the real Google Play experience.

Malvertising helps bring victims directly to the malware

Researchers found evidence that at least one campaign targeting Italy used:

  • geographic filtering;
  • mobile User-Agent checks; and
  • Meta Pixel tracking identifiers.

Group-IB believes the Meta Pixel identifiers indicate that the operators may have abused Meta’s advertising ecosystem to drive traffic toward the malicious download pages.

That makes the distribution model particularly relevant.

Instead of relying only on SMS phishing or direct messages, attackers can potentially use advertising platforms to reach users who are already searching for entertainment applications.

The victim may therefore encounter the malicious content during what appears to be an ordinary browsing or app-discovery session.

The malware first tries to weaken Android’s built-in protection

One of RemControl’s more notable techniques appears immediately after execution.

The dropper starts a VPN service designed to interfere with traffic from Google Play services.

According to Group-IB, this prevents Google Play Protect from performing its normal real-time checks against known malicious applications.

That is significant because malware authors increasingly understand that installing malicious software is only half the problem.

They must also prevent security controls from recognizing and removing it.

Rather than attempting to disable Android security software directly, RemControl manipulates network connectivity around those services.

A similar tactic has also been observed in newer variants of ToxicPanda, suggesting that interference with Play Protect may be becoming a more attractive technique among Android banking-malware operators.

Accessibility permission gives the malware its real power

During installation, RemControl requests access to Android’s Accessibility Service.

Accessibility is designed to help users who need assistance interacting with applications.

Unfortunately, the same capabilities are extremely attractive to malware.

Once granted, Accessibility access can allow malicious software to observe what appears on the screen and interact with interface elements on behalf of the user.

In RemControl’s case, this becomes the foundation for much of its malicious functionality.

The malware can:

  • monitor UI changes;
  • capture text entered into applications;
  • observe clicks and focus events;
  • take screenshots;
  • perform taps and swipes;
  • scroll interfaces;
  • perform long presses;
  • inject text; and
  • navigate applications remotely.

At that point, the malware is no longer simply stealing data.

It is effectively providing the operator with a remote-control layer over the victim’s phone.

Banking overlays remain a central component

RemControl includes more than 30 phishing overlays designed to impersonate legitimate banking applications.

When the malware detects that the victim has opened a targeted app, it can place a convincing full-screen phishing interface over the legitimate application.

The victim believes they are interacting with their bank.

Instead, the information they enter is sent to the attacker.

Depending on the overlay, this can include:

  • banking usernames;
  • passwords;
  • PINs;
  • card expiry dates;
  • security codes; and
  • other authentication information.

Overlay attacks remain effective because users are interacting with the app they intended to open.

The malicious interface appears only after the legitimate banking application launches.

That makes the deception substantially more convincing than a conventional phishing website arriving by email.

The target list can change dynamically

An especially important feature is that RemControl does not rely solely on a hard-coded list of banking applications.

The malware can retrieve updated target information from its command-and-control infrastructure.

That allows operators to add new banks or financial applications without rebuilding and redistributing the malware.

From a defensive perspective, this means the current list of affected banks should not be considered final.

A malware sample initially targeting a small number of financial institutions can potentially expand rapidly once operators decide another region or bank is profitable.

The malware can capture the victim’s Android unlock pattern

RemControl also includes functionality to capture Android pattern-lock coordinates.

Group-IB observed support covering multiple Android vendors and implementations, including:

  • Samsung;
  • Xiaomi;
  • Huawei;
  • OPPO;
  • OnePlus; and
  • stock Android.

This is particularly concerning because device-unlock information can have consequences beyond an individual banking app.

The attacker may be able to obtain knowledge of the victim’s device-authentication pattern while simultaneously controlling application interfaces.

This expands the possible impact from stolen banking credentials toward broader device compromise.

Real-time screen streaming changes the fraud model

RemControl can send both screenshots and the Android Accessibility UI tree to the operator in real time.

The UI tree gives the attacker structured information describing visible interface elements rather than merely a picture of the screen.

That can make remote operation substantially more reliable.

Instead of guessing where a button is located based solely on coordinates, the attacker can understand what interface objects are currently available.

When combined with remote taps, swipes, gestures, and text input, RemControl begins to resemble a remote-access trojan specifically optimized for financial fraud.

This can support fraud even where banking interfaces change.

The criminal can adapt interactively rather than depending entirely on preprogrammed automation.

Remote-control malware can undermine some authentication protections

Modern banks increasingly rely on:

  • one-time passwords;
  • push notifications;
  • device binding;
  • transaction confirmation;
  • behavioral verification; and
  • application-level authentication.

Remote-control malware creates a difficult security problem because the fraudulent action may occur on the victim’s own registered device.

From the bank’s perspective, several signals may therefore appear legitimate.

The device is familiar.

The banking application is genuine.

The session may originate from the victim’s normal IP environment.

And the attacker may interact with the app through the same interface the legitimate user would use.

This is why device takeover and on-device fraud have become such significant concerns in mobile banking security.

RemControl actively resists removal

The malware also attempts to prevent victims from removing it.

When users enter Android areas associated with:

  • application management;
  • Accessibility settings; or
  • factory-reset functions,

RemControl can detect the navigation and automatically force the victim back out of those screens.

This gives the malware a form of defensive awareness.

The attacker is not merely trying to remain unnoticed.

The malware actively reacts when the victim attempts actions that might remove it.

For an infected user, this can make normal remediation unexpectedly difficult.

Telegram provides resilient command-and-control discovery

RemControl retrieves encrypted command-and-control information from Telegram channels.

That design allows operators to change their backend infrastructure without modifying the malware installed on victims’ phones.

If defenders disable one C2 server, the attackers can potentially publish a replacement location through the Telegram-based mechanism.

The malware then discovers the new endpoint dynamically.

This is a common advantage of abusing legitimate platforms.

Telegram infrastructure is highly available and widely used for legitimate communication.

Blocking all Telegram access simply to disrupt one malware family may therefore create significant collateral impact.

Defenders instead need to identify how the malicious application is interacting with the service.

An exposed FastAPI interface revealed part of the criminal infrastructure

Group-IB also discovered that the attackers had inadvertently exposed FastAPI documentation on an early command-and-control proxy.

That documentation provided researchers with information about backend endpoints used to:

  • retrieve phishing overlays; and
  • submit stolen credentials.

This is a useful reminder that attackers make operational-security mistakes too.

Criminal infrastructure is still software infrastructure.

Misconfigured development frameworks, exposed APIs, debug interfaces, and improperly secured administration panels can provide defenders and researchers with valuable intelligence.

There are indications AI was used during development

Researchers discovered an unusual artifact inside one phishing overlay: content that appeared to be an AI assistant response.

Group-IB considers this strong evidence that AI tools were used during development of at least part of the phishing infrastructure.

This does not mean AI autonomously created RemControl.

The more reasonable conclusion is that the developers appear to have used an AI assistant while building the overlay and accidentally left generated content behind.

Nevertheless, it illustrates a broader trend.

Cybercriminals are increasingly using generative AI for ordinary development work such as:

  • writing HTML;
  • translating phishing pages;
  • generating JavaScript;
  • debugging code;
  • creating user interfaces; and
  • adapting lures for different regions.

AI does not need to invent a sophisticated new attack technique to be useful to criminals.

Simply reducing development time and localization effort can help threat actors scale campaigns more rapidly.

Malware-as-a-service makes the threat easier to scale

RemControl is described as a malware-as-a-service (MaaS) platform.

That business model is significant because the malware developer does not necessarily need to conduct every fraud campaign personally.

Instead, access to the malware can potentially be sold or rented to other criminals.

MaaS platforms separate technical capability from criminal operations.

One group develops and maintains the malware.

Other operators handle:

  • advertising;
  • victim acquisition;
  • phishing;
  • financial fraud; and
  • cash-out.

This lowers the technical barrier for criminals who may not have the expertise required to build sophisticated Android malware themselves.

Researchers suspect a possible connection with Medusa

Group-IB tracks the RemControl operator under the identifier UNKK.

Researchers identified common identifiers in analyzed samples that suggest a possible connection to the Medusa banking trojan ecosystem.

However, the origin and identity of the RemControl operators remain uncertain.

Russian-language content found inside some phishing overlays indicates that at least some development may have involved a Russian-speaking person.

That is an indicator, not attribution.

Language inside malware or phishing infrastructure is not sufficient by itself to establish nationality or actor identity.

What should Android users do?

The most important protection is to avoid installing APK packages from websites pretending to be official app stores.

Users should:

Install applications through Google Play or other explicitly trusted sources.

A webpage visually resembling Google Play is not the same as the Google Play application.

Treat Accessibility requests with suspicion.

A streaming application generally has little legitimate reason to require broad Accessibility control.

Keep Google Play Protect enabled.

Users should regularly verify that Play Protect is operating correctly.

Avoid following advertisements directly to APK downloads.

Searching for the application independently in the official Play Store is safer.

Review installed applications periodically.

Unexpected applications, particularly those with Accessibility or VPN permissions, deserve investigation.

Pay attention when system settings behave strangely.

If Android repeatedly closes Accessibility, application-management, or reset screens while the user is trying to remove an application, compromise should be considered.

Banks also need to detect on-device fraud

RemControl demonstrates why protecting customers can no longer depend only on detecting credential theft.

Financial institutions increasingly need behavioral and device intelligence capable of recognizing suspicious transaction patterns even when valid credentials are used.

Useful signals may include:

  • abnormal transaction timing;
  • unusual beneficiary creation;
  • rapid navigation inconsistent with normal human behavior;
  • changes in device characteristics;
  • unexpected transaction amounts;
  • suspicious accessibility behavior where telemetry is available; and
  • anomalies between historical customer behavior and current activity.

No single indicator is sufficient.

The objective is to detect when apparently valid banking activity is occurring under attacker control.

Android Accessibility remains a major security battleground

Accessibility abuse appears repeatedly across modern Android banking malware families because of the extraordinary capabilities it can provide.

Android and application developers therefore face a difficult balance.

Accessibility functions are essential for legitimate users.

They cannot simply be removed.

Security improvements must instead focus on identifying when applications request these capabilities without a credible accessibility purpose.

Users should understand that granting Accessibility permissions is closer to granting remote-control capability than providing an ordinary app permission such as access to notifications.

The broader cybersecurity lesson

RemControl brings together many of the techniques defining modern Android financial malware:

malvertising → fake app store → sideloaded APK → Play Protect interference → Accessibility abuse → phishing overlays → screen monitoring → remote device control → pattern-lock capture → anti-removal behavior → resilient C2 infrastructure

Each stage reinforces the next.

The fake Google Play page convinces the victim to install the application.

The VPN mechanism attempts to weaken malware detection.

Accessibility provides visibility and control.

Phishing overlays collect credentials.

Remote-control features let criminals interact directly with banking applications.

Anti-removal functionality helps maintain access.

Telegram gives the backend resilience.

The result is no longer simply a “banking credential stealer.”

It is much closer to a fraud platform running directly on the victim’s phone.

That distinction matters.

As banking security improves, attackers increasingly attempt to operate inside the same trusted device and legitimate applications as the customer.

The future of mobile banking fraud may therefore depend less on stealing a password and more on stealing control of the authenticated device itself.

RemControl is another indication that this transition is already well underway.

A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application. [...]

Source: New RemControl Android banking malware targets users in Europe and Canada via Bleeping Computer — published 23 Sep 2026.