2 mentions in 7 days · 2 in 30 days · 2 total · first seen · last
RemControl Android malware steals banking PINs by targeting over 30 banks in multiple countries.
RemControl Android malware steals banking PINs by targeting over 30 banks in multiple countries, using fake TV app delivery and custom crypto.
Group-IB says RemControl, a new Android banking trojan, steals PINs from customers of more than 30 banks.
Group-IB identified RemControl, an Android banking trojan distributed through fake Google Play pages impersonating the TVTap IPTV app, with first VirusTotal samples submitted on July 19, 2026. It targets customers of more than 30 banks in Italy, France, Spain, Poland, Portugal, Canada, and some Gulf states, including an Italian campaign limited to Italian IP addresses and promoted with Meta ads. After the victim grants VPN and Accessibility permissions, it blocks Play Protect, signs each payload with a unique certificate, overlays banking apps to steal PINs and card data, captures the screen and keystrokes, and blocks uninstallation. Command-and-control addresses are hidden in public Telegram channels, the backend documentation suggests AI-assisted development, and Group-IB tracks the operator as UNKK with a possible link to Medusa affiliate UNKN.