New RemControl Android banking malware targets users in Europe and Canada
New RemControl Android banking MaaS steals credentials via 30+ phishing overlays targeting Europe, Canada, and the Middle East.
Group-IB reports RemControl, a new Android malware-as-a-service spread via malvertising and fake Google Play pages impersonating the TVTap IPTV app. It abuses Accessibility Services to show 30+ banking phishing overlays, capture inputs and pattern locks, stream screens in real time, and remotely control devices, while a VPN service blocks Play Protect checks. C2 configuration is fetched from Telegram for infrastructure rotation; the operator is tracked as UNKK with a possible Medusa link, and overlays show signs of AI-assisted development plus Russian-language artifacts.
- Distributed via malvertising and fake Google Play pages impersonating TVTap IPTV
- Blocks Google Play Protect by starting VPN service during dropper stage
- Accessibility abuse enables overlays, keylogging, pattern-lock theft, remote taps
- C2 addresses rotated via Telegram; exposed FastAPI docs revealed overlay/credential endpoints
- Operator tracked as UNKK, suspected link to Medusa banking trojan
- ATT&CK
- T1566.002 Spearphishing LinkT1204.003 Malicious FileT1056.002 GUI Input CaptureT1113 Screen Capture
- Tags
- androidbanking-trojanmalware-as-a-servicephishing-overlaysmalvertisingaccessibility-abusegroup-ibremcontrol
- Threat actors
- Medusa
- Organizations
- Group-IBRemControlUNKKToxicPandaTVTap
From the original article
2 min read at bleepingcomputer.com.jpg&w=1280&q=75)
A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.