The malware targets customers in Western Europe, the Middle East, and Canada. Researchers confirmed phishing overlays for more than 30 financial institutions.
First observed in samples from July 2026, RemControl is distributed through fake Google Play Store pages advertising TVTap, an IPTV app.
Group-IB identified malvertising as one delivery channel. In an Italian campaign, the download pages showed the malicious APK only to visitors using mobile devices with Italian IP addresses.
The downloaded dropper presents a TVTap update screen. When a user starts installation, it launches a local VPN service that blocks network traffic from the Google Play Store app, interfering with real-time Play Protect checks.
It then creates a new signing certificate for the malware payload on each installation, making certificate-based detection harder, before installing the payload.
RemControl Trojan Steals Banking PINs
Once installed, RemControl asks the user to enable Android’s Accessibility Service. If granted, that permission lets the trojan detect which app is open, read interface content, and perform actions on the device.
When a targeted banking app appears, RemControl displays a full-screen phishing page supplied by its command-and-control (C2) server. The page can request a PIN, mobile banking code, or card expiry date.
After submission, it closes and reveals the real banking app beneath it.
The malware can also capture screenshots, stream the screen’s interface structure, log typing-related events, and remotely tap, swipe, or enter text.
Group-IB found code designed to capture lock-screen patterns on several Android device types. RemControl also tries to prevent victims from opening settings used to remove the app or revoke its permissions.
Instead of storing a fixed C2 address in the app, RemControl retrieves an encrypted address from a Telegram page. This lets operators change servers without rebuilding the malware. Its main connection uses WebSocket, with HTTP as a fallback.
Group-IB found publicly accessible API documentation for both a C2 proxy and an operator panel.
The panel exposed features for managing infected devices, editing phishing overlays, recording remote-control sessions, and generating APK builds with affiliate tags. These features indicate a Malware-as-a-Service operation.
The investigation also found signs of AI-assisted development. API documentation described banking credential submissions as “quiz answers,” while one phishing page contained a complete AI assistant response accidentally left in its HTML.
These artifacts support AI involvement in building parts of the infrastructure and overlays; they do not show that AI independently selected victims or ran the campaign.
Indicators of Compromise
| Indicator | Type | Description |
|---|---|---|
hxxps[:]//tvtap-hd[.]app/ | URL | Fake TVTap download page |
hxxp[:]//vpn[.]doneplay[.]site/ | URL | Fake TVTap download page |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
