RemControl Android Malware Targets Banking Users in Europe and Canada

RemControl Android malware targets banking users through fake downloads of the TVTap IPTV app. Researchers found campaigns aimed at people in Italy, France, Spain, Poland, Portugal, Canada and parts of the Middle East.

Fake TVTap Pages Lead to Malicious Downloads

According to Group-IB, the attackers’ infrastructure has operated since at least May 2026. Researchers first observed malware samples in July.

The attackers use online advertisements to direct people to fake Google Play pages for TVTap. Group-IB found that at least one campaign in Italy checked visitors’ locations and devices before showing the download page.

The pages also contained Meta Pixel tracking IDs. Group-IB considers this a possible sign that the attackers used Meta’s advertising ecosystem to attract visitors.

RemControl Tries to Evade Security Checks

After installation, the malicious app starts a VPN service that blocks traffic from Google Play services. This can interfere with Play Protect’s real-time malware checks.

The app then asks for Android Accessibility Service permission. If a user grants it, RemControl can monitor activity across apps and control parts of the device.

Banking Overlays Steal Credentials

Group-IB found more than 30 phishing overlays in the first samples. RemControl Android malware displays these screens over legitimate banking apps to collect passwords, PINs, banking codes and payment card details.

The malware can receive new banking targets from its command-and-control servers. It can also stream screenshots and details of the phone’s interface to an operator. In addition, it records user input and allows remote taps, swipes and text entry.

RemControl can capture pattern-lock movements on several Android phone brands. It also tries to prevent removal by closing certain settings screens when a user opens them.

Researchers Investigate the Operators

RemControl retrieves encrypted server information from Telegram channels. As a result, its operators can change infrastructure if a server stops working.

Group-IB also found exposed documentation on an initial command-and-control proxy. It revealed how the malware downloaded banking overlays and submitted stolen credentials.

The researchers have not identified the operators. They track one operator as UNKK and suspect a connection to the Medusa banking trojan. Russian-language text in some overlay files suggests that a Russian speaker developed at least part of the malware. However, it does not establish the operator’s identity.

How Android Users Can Reduce the Risk

Avoid installing APK files from publishers you do not trust. Also, question requests for Accessibility Service access from apps that have no clear reason to need it. Regular Play Protect scans can help detect malicious apps.