UNKK (Threat actor): news timeline & CVEs

RemControl Banking Trojan Gives Attackers Remote Control of Android Devices

RemControl, an Android banking trojan, remotely controls devices and steals credentials from customers of 30-plus banks.

Group-IB describes RemControl, an Android banking trojan that abuses Accessibility Services to remotely control devices and steal PINs, mobile-banking codes, and card expiry dates. It has targeted customers of more than 30 banks across six countries in Western Europe, the Middle East, and Canada since July 2026. Victims are lured by fake Google Play pages impersonating TVTap; a dropper routes Play Protect through a null VPN, signs the payload with a fresh key, and requests Accessibility access for overlays, screen capture, keylogging, and resistance to removal. Operator UNKK, described as Russian-speaking, appears to have used an AI assistant to build portions of the C2 backend and phishing overlays, and stolen data is relayed through a Telegram dead-drop and WebSocket channel.

Infosecurity MagazineSep 25, 09:30 UTC · 2d agoMalware in the wild 6 sources

New Android Banking Trojan Uses AI-Built Overlays to Steal Users’ Banking PINs

RemControl, a new Android banking trojan, uses fake streaming-app downloads and overlays to steal banking PINs.

Group-IB identified RemControl, an Android banking trojan first seen in July 2026, delivered through fake Google Play-style pages for a TV streaming app and geo-filtered in at least one Italian campaign. When a targeted banking app opens, it shows a full-screen overlay that captures PINs, codes, and card details, then hides; operators can log keystrokes, stream screenshots, and control the device after Accessibility access is granted. Matching overlays cover more than 30 banks across Europe, the Middle East, and Canada, with Italy and France the main observed targets. Server notes and a leftover AI-assistant reply indicate an AI tool helped build parts of the platform, while C2 locations are retrieved through Telegram under an affiliate label UNKK.

Cyber Security Newsupdated Sep 25, 09:30 UTC · 2d agofirst Sep 24, 10:04 UTC · 2d agoMalware in the wild 6 sources

Hackers Exploit Check Point VPN RCE and Management Zero-Day in Attacks

RemControl Android malware steals banking PINs by targeting over 30 banks in multiple countries.

RemControl Android malware steals banking PINs by targeting over 30 banks in multiple countries, using fake TV app delivery and custom crypto.

GBHackersupdated Sep 25, 09:30 UTC · 2d agofirst Sep 24, 09:41 UTC · 3d agoOther 6 sources

New Android malware RemControl steals banking PINs and blocks removal attempts

Group-IB says RemControl, a new Android banking trojan, steals PINs from customers of more than 30 banks.

Group-IB identified RemControl, an Android banking trojan distributed through fake Google Play pages impersonating the TVTap IPTV app, with first VirusTotal samples submitted on July 19, 2026. It targets customers of more than 30 banks in Italy, France, Spain, Poland, Portugal, Canada, and some Gulf states, including an Italian campaign limited to Italian IP addresses and promoted with Meta ads. After the victim grants VPN and Accessibility permissions, it blocks Play Protect, signs each payload with a unique certificate, overlays banking apps to steal PINs and card data, captures the screen and keystrokes, and blocks uninstallation. Command-and-control addresses are hidden in public Telegram channels, the backend documentation suggests AI-assisted development, and Group-IB tracks the operator as UNKK with a possible link to Medusa affiliate UNKN.

Help Net Securityupdated Sep 25, 09:30 UTC · 2d agofirst Sep 24, 09:40 UTC · 3d agoMalware in the wild 6 sources

RemControl Android Malware Targets 30+ Banking Apps to Steal PINs and Credentials

RemControl Android trojan overlays 30-plus banking apps, stealing PINs and streaming screens through accessibility abuse.

Group-IB reports RemControl, an Android banking trojan operated as malware-as-a-service since at least May 2026, with the earliest operator tracked as UNKK. Campaigns use fake Google Play pages impersonating TVTap, geolocation and User-Agent checks, and malvertising to deliver a dropper that blocks Play Protect connectivity and signs each payload uniquely. After Accessibility Service access, it overlays more than 30 banking apps across Europe, the Middle East, and Canada to steal PINs and credentials, while streaming screenshots and the accessibility tree. Telegram channels act as a dead-drop resolver for WebSocket command-and-control, and researchers noted a possible link to the Medusa affiliate ecosystem.

GBHackersupdated Sep 25, 09:30 UTC · 2d agofirst Sep 24, 07:21 UTC · 3d agoMalware in the wild 6 sources

UNKK

Timeline5 articles

Appears with

RemControl Banking Trojan Gives Attackers Remote Control of Android Devices

New Android Banking Trojan Uses AI-Built Overlays to Steal Users’ Banking PINs

Hackers Exploit Check Point VPN RCE and Management Zero-Day in Attacks

New Android malware RemControl steals banking PINs and blocks removal attempts

RemControl Android Malware Targets 30+ Banking Apps to Steal PINs and Credentials