Reported by 3 outlets
RemControl Android malware targets European and Canadian users via fake Play Store pages
Why this score
- Breadth
- 1.50 / 2.0 · 3 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
Group-IB disclosed RemControl on September 23, 2026: an Android banking trojan distributed through fake Google Play pages that pose as a TV streaming app. Victims are pushed to grant Accessibility Service access, after which the trojan needs no phishing content at all; it simply watches and drives the screen. Reporting puts the target set at more than 30 banks across six countries in Europe and Canada.
The distribution method is the notable part. Instead of trojanized APKs on the real Play Store, the operators stand up counterfeit Play Store pages that look legitimate enough to pass casual inspection, then abuse Android's accessibility permissions to overlay, capture, and control banking sessions remotely.
Watch for additional fake store domains and app impersonations, expansion of the target bank list beyond the current six countries, and whether Google removes the associated developer accounts. Device-side defenses that matter are restricting Accessibility Service grants and verifying app install sources.
Timeline
-
original reporting
RemControl targets European and Canadian Androids with fake Play Store pages
linuxmint.hu · 17d ago · September 26th, 2026
RemControl targets European and Canadian Android devices with fake Play Store pages. Would you grant an app Accessibility Service access if it claimed to be your bank?
via Mastodon https://linuxmint.hu/hir/2026/09/europai-es-kanadai-felhasznalokat-vesz-celba-az-androidos-remcontrol
-
update from www.infosecurity-magazine.com
RemControl Targets 30+ Banks Across Six Countries https:// infosecurity-magazine.com/news/banking-t rojan-remote-control/ … RemControl is a
www.infosecurity-magazine.com · 17d ago · September 26th, 2026
RemControl Targets 30+ Banks Across Six Countries https:// infosecurity-magazine.com/news/banking-t rojan-remote-control/ … RemControl is a
via X https://www.infosecurity-magazine.com/news/banking-trojan-remote-control/
-
update from www.group-ib.com
Group-IB (Sep 23) on RemControl, an Android banking trojan spread through fake Google Play pages for a TV streaming app: no phishing content
www.group-ib.com · 8d ago · October 5th, 2026
Group-IB (Sep 23) on RemControl, an Android banking trojan spread through fake Google Play pages for a TV streaming app: no phishing content
via Mastodon https://www.group-ib.com/blog/remcontrol-android-banking-trojan/