Reported by 10 outlets
RemControl Android Banking Trojan Steals PINs Using AI-Built Phishing Overlays
Why this score
- Breadth
- 2.00 / 2.0 · 10 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Group-IB disclosed RemControl on September 23, 2026: a previously undocumented Android banking trojan operated as a malware-as-a-service platform by an affiliate tracked as UNKK, with first VirusTotal samples on July 19, 2026 and C2 domain bnbnhura[.]top registered May 12, 2026. Delivery runs through malvertising and fake Google Play pages impersonating the TVTap IPTV app, with at least one Italian campaign using geofencing and mobile User-Agent checks to serve the APK only to targets, and Meta Pixel tracking IDs on the download pages pointing to abuse of Meta's ad ecosystem.
The dropper's anti-analysis is the distinctive part. It requests BIND_VPN_SERVICE and routes com.android.vending traffic into a null tunnel so Play Protect cannot perform real-time checks, a trick also seen in a recent ToxicPanda version, then signs each payload with a fresh certificate under CN=Android Debug to defeat certificate-based detection. Once installed, it abuses the Accessibility Service to detect the foreground app and display full-screen phishing overlays served from C2 for more than 30 financial institutions across Italy, France, Spain, Poland, Portugal, Canada, and GCC states, requesting PINs, mobile banking codes, and card expiry details before revealing the real app. It also supports real-time screen streaming and remote control. Group-IB notes one overlay displaying an AI assistant response, a strong indication the overlays were built with AI models, and assesses a possible link to the Medusa UNKN botnet: droppers sharing the instaltvtap.apk naming convention carried Medusa UNKN payloads until July 2026, then switched to RemControl, whose UNKK tag differs by one letter.
The practical exposure is mobile users of banks in Western Europe, the Middle East, and Canada arriving through ad channels rather than the official store. Watch for expansion of the overlay target list beyond the current 30-plus institutions, additional operators renting the MaaS platform beyond UNKK, and whether the Medusa UNKN connection is confirmed, which would fold RemControl into an established distribution pipeline.
Timeline
-
original reporting
RemControl Android Banking Trojan Steals PINs Using AI-Built Phishing Overlays
cyberpress.org · 19d ago · September 24th, 2026
The malware targets customers in Western Europe, the Middle East, and Canada. Researchers confirmed phishing overlays for more than 30 financial institutions. First observed in samples from July 2026, RemControl is distributed through fake Google Play Store pages advertising TVTap, an IPTV app. Group-IB identified malvertising as one delivery channel. In an Italian campaign, the download pages showed the malicious APK only to visitors using mobile devices with Italian IP addresses. The downloaded dropper presents a TVTap update screen. When a user starts installation, it launches a local VPN service that blocks network traffic from the Google Play Store app, interfering with real-time Play Protect checks. It then creates a new signing certificate for the malware payload on each installation, making certificate-based detection harder, before installing the payload. RemControl Trojan Steals Banking PINs Once installed, RemControl asks the user to enable Android’s Accessibility Service. If granted, that permission lets the trojan detect which app is open, read interface content, and perform actions on the device. When a targeted banking app appears, RemControl displays a full-screen phishing page supplied by its command-and-control (C2) server. The page can request a PIN, mobile banking code, or card expiry date. Fake Google Play phishing page (in Italian) (Source: group-ib) After submission, it closes and reveals the real banking app beneath it. The malware can also capture scr
-
update from cleafy.com
Medusa Reborn: A New Compact Variant Discovered
cleafy.com · 846d ago · June 20th, 2024
Cleafy Labs report published June 20, 2024 documenting the Medusa UNKN botnet, which targeted European users with campaigns focused on Italy and France, was installed via droppers downloaded from untrusted sources, and resolved its C2 address through social media dead-drops including Telegram. Group-IB's RemControl report cites this work: droppers sharing the instaltvtap.apk naming convention carried Medusa UNKN payloads until July 2026, then switched to RemControl, and the UNKN tag differs by one letter from RemControl's UNKK affiliate tag. This is the earliest reporting on the distribution channel RemControl now rides on.
-
update from group-ib.com
RemControl: AI Built the Overlays. Victims Lose their PINs
group-ib.com · 20d ago · September 23rd, 2026
Original researcher disclosure by Group-IB reverse engineer Bruno Bijelic, timestamped Wed, 23 Sep 2026 07:26:04 GMT in the Group-IB blog feed, about five hours before this story's first event. It documents RemControl as a previously undocumented Android banking trojan run as a Malware-as-a-Service platform, tracked to operator UNKK, with first VirusTotal samples on July 19, 2026 and C2 domain bnbnhura[.]top registered May 12, 2026. The dropper requests BIND_VPN_SERVICE and routes com.android.vending into a null tunnel to suppress Play Protect real-time checks, then signs each payload with a fresh certificate under subject CN=Android Debug, O=Android, C=US. It confirms more than 30 phishing overlay targets across Italy, France, Spain, Poland, Portugal, Canada and GCC member states, and assesses a possible link to the Medusa UNKN affiliate botnet.
-
update from bleepingcomputer.com
RemControl Android banking malware targets users in Europe and Canada
bleepingcomputer.com · 20d ago · September 23rd, 2026
Although the infrastructure has been active since at least May, the first samples were observed in July and contained more than 30 phishing overlays designed to steal banking credentials. In one of the overlays, the malware displays an AI assistant response, a strong indication that it has been built with the help of AI models. The malicious sites include Meta Pixel tracking IDs, which Group-IB sees as a hint that the operator abused Meta’s advertising ecosystem to drive victims to the download pages. The feature has also been observed in a recent version of the ToxicPanda malware , a much bigger operation that uses phishing overlays for 349 financial, cryptocurrency, and digital wallets applications used in
-
update from www.bleepingcomputer.com
New RemControl Android banking malware targets users in Europe and Canada https:// bleepingcomputer.com/news/security/ new-remcontrol-androi
www.bleepingcomputer.com · 20d ago · September 23rd, 2026
New RemControl Android banking malware targets users in Europe and Canada https:// bleepingcomputer.com/news/security/ new-remcontrol-androi
via X https://www.bleepingcomputer.com/news/security/new-remcontrol-android-banking-malware-targets-users-in-europe-and-canada/
-
mentioned by deafnews.it
RemControl Android banking trojan uses AI to clone home banking apps, targeting users across Europe, Canada and GCC states via fake IPTV app
deafnews.it · 20d ago · September 24th, 2026
-
update from gbhackers.com
RemControl Android Malware Targets 30+ Banking Apps to Steal PINs and Credentials
gbhackers.com · 19d ago · September 24th, 2026
The malware combines fake Google Play pages, Android Accessibility Service abuse, credential-stealing overlays, real-time screen streaming, and remote-control functions to compromise mobile banking sessions. The company tracks the operator behind the […] The post RemControl Android Malware Targets 30+ Banking Apps to Steal PINs and Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
mentioned by tugatech.com.pt
New malware RemControl attacks Android banking clients using AI, targeting users in Europe
tugatech.com.pt · 19d ago · September 24th, 2026
-
mentioned by www.bleepingcomputer.com
🚨📱 Security researchers have identified a new Android malware called RemControl, spreading through ads pretending to be the TVTap streaming
www.bleepingcomputer.com · 19d ago · September 24th, 2026
-
mentioned by securityonline.info
Group-IB found the RemControl Android banking trojan, a new malware using AI phishing overlays and fake TVTap apps to steal banking PINs and
securityonline.info · 15d ago · September 28th, 2026
-
update from linuxiarze.pl
Bankowy trojan na Androida wykorzystuje AI i fałszywe strony w sklepie Play do okradania użytkowników. Group-IB odkrył RemControl, trojana b
linuxiarze.pl · 15d ago · September 28th, 2026
Bankowy trojan na Androida wykorzystuje AI i fałszywe strony w sklepie Play do okradania użytkowników.