RemControl (Malware): news timeline & CVEs

In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure

Roundup: ShinyHunters defaced Cl0p’s leak site, new secret-stealing implants emerged, and US water credentials were exposed.

SecurityWeek’s weekly roundup reports that ShinyHunters defaced the Cl0p ransomware gang’s Tor leak site, claiming theft of logs, source code and onion-service keys, and demanded an eight-figure payment. Malicious MemOS packages on npm and PyPI carry a Go implant named sckit that steals developer and cloud secrets, while Cisco Talos documented CLOSEDQUORUM, which has DeepSeek, Qwen, Mistral and Gemini vote on credential theft and persistence. SpyCloud found infostealer exposure at 1,787 of about 10,000 US water-sector organizations, including OT or remote-access credentials at 258. Separately, CVE-2026-42542 is an unauthenticated denial-of-service flaw in TDengine 3.4.0.0 through 3.4.1.5.

SecurityWeekSep 25, 15:07 UTC · 1d agoMalware in the wildCVE-2026-42542

RemControl Banking Trojan Gives Attackers Remote Control of Android Devices

RemControl, an Android banking trojan, remotely controls devices and steals credentials from customers of 30-plus banks.

Group-IB describes RemControl, an Android banking trojan that abuses Accessibility Services to remotely control devices and steal PINs, mobile-banking codes, and card expiry dates. It has targeted customers of more than 30 banks across six countries in Western Europe, the Middle East, and Canada since July 2026. Victims are lured by fake Google Play pages impersonating TVTap; a dropper routes Play Protect through a null VPN, signs the payload with a fresh key, and requests Accessibility access for overlays, screen capture, keylogging, and resistance to removal. Operator UNKK, described as Russian-speaking, appears to have used an AI assistant to build portions of the C2 backend and phishing overlays, and stolen data is relayed through a Telegram dead-drop and WebSocket channel.

Infosecurity MagazineSep 25, 09:30 UTC · 2d agoMalware in the wild 6 sources

ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories

ThreatsDay details the RemControl Android banking trojan, a ZCode source leak, and related phishing and ICS risks.

Group-IB described RemControl, an Android banking trojan first seen in July 2026, targeting retail customers in Italy, France, Spain, Poland, Portugal, the Middle East, and Canada through fake TVTap Google Play pages promoted in Meta ads. It abuses Accessibility Service for phishing overlays, live screen streaming, keylogging, and remote control, and resolves command-and-control through an encrypted Telegram dead-drop; Russian-language comments and a possible link to the Medusa UNKN affiliate botnet were noted. Separately, Z.ai disabled ZCode features that uploaded local code repositories to Alibaba Cloud by default, and FBI and CISA warned critical-infrastructure operators about broad access for third-party ICS integrators. The bulletin also describes surveillance features in Russia's MAX super-app and a fake Claude Max giveaway that steals Google credentials with a browser-in-the-browser login.

The Hacker NewsSep 24, 17:52 UTC · 2d agoMalware in the wild

New Android Banking Trojan Uses AI-Built Overlays to Steal Users’ Banking PINs

RemControl, a new Android banking trojan, uses fake streaming-app downloads and overlays to steal banking PINs.

Group-IB identified RemControl, an Android banking trojan first seen in July 2026, delivered through fake Google Play-style pages for a TV streaming app and geo-filtered in at least one Italian campaign. When a targeted banking app opens, it shows a full-screen overlay that captures PINs, codes, and card details, then hides; operators can log keystrokes, stream screenshots, and control the device after Accessibility access is granted. Matching overlays cover more than 30 banks across Europe, the Middle East, and Canada, with Italy and France the main observed targets. Server notes and a leftover AI-assistant reply indicate an AI tool helped build parts of the platform, while C2 locations are retrieved through Telegram under an affiliate label UNKK.

Cyber Security Newsupdated Sep 25, 09:30 UTC · 2d agofirst Sep 24, 10:04 UTC · 2d agoMalware in the wild 6 sources

Hackers Exploit Check Point VPN RCE and Management Zero-Day in Attacks

RemControl Android malware steals banking PINs by targeting over 30 banks in multiple countries.

RemControl Android malware steals banking PINs by targeting over 30 banks in multiple countries, using fake TV app delivery and custom crypto.

GBHackersupdated Sep 25, 09:30 UTC · 2d agofirst Sep 24, 09:41 UTC · 3d agoOther 6 sources

New Android malware RemControl steals banking PINs and blocks removal attempts

Group-IB says RemControl, a new Android banking trojan, steals PINs from customers of more than 30 banks.

Group-IB identified RemControl, an Android banking trojan distributed through fake Google Play pages impersonating the TVTap IPTV app, with first VirusTotal samples submitted on July 19, 2026. It targets customers of more than 30 banks in Italy, France, Spain, Poland, Portugal, Canada, and some Gulf states, including an Italian campaign limited to Italian IP addresses and promoted with Meta ads. After the victim grants VPN and Accessibility permissions, it blocks Play Protect, signs each payload with a unique certificate, overlays banking apps to steal PINs and card data, captures the screen and keystrokes, and blocks uninstallation. Command-and-control addresses are hidden in public Telegram channels, the backend documentation suggests AI-assisted development, and Group-IB tracks the operator as UNKK with a possible link to Medusa affiliate UNKN.

Help Net Securityupdated Sep 25, 09:30 UTC · 2d agofirst Sep 24, 09:40 UTC · 3d agoMalware in the wild 6 sources

RemControl Android Malware Targets 30+ Banking Apps to Steal PINs and Credentials

RemControl Android trojan overlays 30-plus banking apps, stealing PINs and streaming screens through accessibility abuse.

Group-IB reports RemControl, an Android banking trojan operated as malware-as-a-service since at least May 2026, with the earliest operator tracked as UNKK. Campaigns use fake Google Play pages impersonating TVTap, geolocation and User-Agent checks, and malvertising to deliver a dropper that blocks Play Protect connectivity and signs each payload uniquely. After Accessibility Service access, it overlays more than 30 banking apps across Europe, the Middle East, and Canada to steal PINs and credentials, while streaming screenshots and the accessibility tree. Telegram channels act as a dead-drop resolver for WebSocket command-and-control, and researchers noted a possible link to the Medusa affiliate ecosystem.

GBHackersupdated Sep 25, 09:30 UTC · 2d agofirst Sep 24, 07:21 UTC · 3d agoMalware in the wild 6 sources

RemControl

Timeline7 articles

Related CVEsby mentions

Appears with