RemControl Android Malware Targets Banking Users in Europe and Canada

RemControl Android malware is targeting banking users through fake download pages for the TVTap IPTV app. Researchers at Group-IB say the campaign reaches users in parts of Europe, Canada and the Middle East.

Fake App Pages Deliver the Malware

The campaign’s infrastructure has operated since at least May 2026. Group-IB first observed malware samples in July. Those samples contained more than 30 phishing overlays designed to collect banking details.

Attackers distribute RemControl through pages that imitate Google Play. At least one campaign aimed at Italian users checked visitors’ locations and mobile browsers before showing the download.

Group-IB also found Meta Pixel identifiers on the malicious pages. The researchers believe this may indicate that the attackers used Meta’s advertising ecosystem to attract visitors.

After installation, the dropper starts a VPN service that blocks traffic from Google Play services. This can prevent Play Protect from checking the malware in real time.

Accessibility Access Enables Banking Theft

RemControl Android malware asks users to grant Accessibility Service permissions. If they agree, it can place full-screen phishing forms over legitimate banking apps.

The overlays can capture credentials, PINs, banking codes and card details. Meanwhile, operators can send the malware new banking targets through its command-and-control system.

The malware can also stream screenshots and information about what appears on the phone’s screen. In addition, it can record user input and remotely perform taps, swipes and other actions.

RemControl tries to resist removal by detecting when a user opens certain settings. It can then exit those screens automatically.

Researchers Investigate the Operators

RemControl retrieves encrypted server information from Telegram channels, allowing its operators to change their infrastructure. Group-IB also found exposed documentation on an early command-and-control server.

The researchers have not identified the people behind the campaign. They found Russian-language text in some phishing overlays and suspect a possible connection to the Medusa banking trojan. However, those clues do not establish who operates RemControl.

One overlay contained what appeared to be an AI assistant response. Group-IB considers it a sign that AI tools may have helped create part of the malware.

Android users can reduce their exposure by avoiding untrusted APK downloads and questioning Accessibility Service requests from apps that do not need that access.