CTI · reviewed · 2026-09-28

RemControl Android Banking Trojan Steals PINs Using AI-Built Phishing Overlays

Full story & timeline

MITRE ATT&CK

• T1566 Phishing Initial Access
• T1056 Input Capture Collection
• T1113 Screen Capture Collection
• T1562 Impair Defenses Stealth
• T1071 Application Layer Protocol Command and Control

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: RemControl Banking Trojan C2 and Distribution Domains
id: 75bde629-be92-402b-9ba8-7cf0c60e52d2
status: experimental
description: 'Detects network connections to the RemControl Android banking trojan infrastructure reported by Group-IB — the C2 domain bnbnhura.top and the fake Google Play distribution domains impersonating the TVTap IPTV app.'
references:
  - https://www.bleepingcomputer.com/news/security/new-remcontrol-android-banking-malware-targets-users-in-europe-and-canada/
  - https://intel.threadlinqs.com/threat/TL-2026-2625
  - https://securityonline.info/remcontrol-android-banking-trojan/
author: Tia N. List
date: 2026-09-28
tags:
  - attack.t1071
  - attack.t1566
logsource:
  category: network_connection
detection:
  selection:
    DestinationHostname|endswith:
      - 'bnbnhura.top'
      - 'tvtap-hd.app'
      - 'tvtap-liveapp.com'
  condition: selection
falsepositives:
  - User traffic to the fake TVTap distribution sites before the dropper installs (victims downloading the APK)
level: high

References

• https://intel.threadlinqs.com/threat/TL-2026-2625
• https://www.bleepingcomputer.com/news/security/new-remcontrol-android-banking-malware-targets-users-in-europe-and-canada/
• https://securityonline.info/remcontrol-android-banking-trojan/