RemControl Android Malware Targets 30+ Banking Apps to Steal PINs and Credentials
RemControl Android trojan overlays 30-plus banking apps, stealing PINs and streaming screens through accessibility abuse.
Group-IB reports RemControl, an Android banking trojan operated as malware-as-a-service since at least May 2026, with the earliest operator tracked as UNKK. Campaigns use fake Google Play pages impersonating TVTap, geolocation and User-Agent checks, and malvertising to deliver a dropper that blocks Play Protect connectivity and signs each payload uniquely. After Accessibility Service access, it overlays more than 30 banking apps across Europe, the Middle East, and Canada to steal PINs and credentials, while streaming screenshots and the accessibility tree. Telegram channels act as a dead-drop resolver for WebSocket command-and-control, and researchers noted a possible link to the Medusa affiliate ecosystem.
- RemControl is an Android banking MaaS trojan active since at least May 2026.
- Fake TVTap Google Play pages and malvertising deliver the dropper APK.
- Accessibility overlays steal PINs and credentials from more than 30 banking apps.
- Operators stream screenshots and the accessibility tree over WebSocket.
- Telegram channels serve as a dead-drop resolver for rotating C2 addresses.
- ATT&CK
- T1204.002 User Execution: Malicious FileT1056 Input CaptureT1113 Screen CaptureT1102.001 Web Service: Dead Drop ResolverT1071.001 Application Layer Protocol: Web Protocols
- Vendors
- Products
- AndroidGoogle Play
- Threat actors
- UNKK
- Malware
- RemControl
- Organizations
- Group-IB
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cdn.dlmafi.top | [.]com/ Distribution – fake TVTAP download website hxxp[:]//cdn[.]dlmafi[.]top/ Distribution – fake TVTAP download website Note: IP ad |
| domain | ff-de.shutgpt.ir | .]site/ Distribution – fake TVTAP download website hxxp[:]//ff-de[.]shutgpt[.]ir/ Distribution – fake TVTAP download website hxxp[:]//vp |
| domain | tvtap-hd.app | sa UNKN affiliate ecosystem. IOCs IOC Description hxxps[:]//tvtap-hd[.]app/ Distribution – fake TVTAP download website hxxp[:]//vpn[ |
| domain | vpn.askarzadeh.com | t[.]ir/ Distribution – fake TVTAP download website hxxp[:]//vpn[.]askarzadeh[.]com/ Distribution – fake TVTAP download website hxxp[:]//cd |
| domain | vpn.doneplay.site | [.]app/ Distribution – fake TVTAP download website hxxp[:]//vpn[.]doneplay[.]site/ Distribution – fake TVTAP download website hxxp[:]//ff |
| url | http://cdn.dlmafi.top/ | skarzadeh[.]com/ Distribution – fake TVTAP download website hxxp[:]//cdn[.]dlmafi[.]top/ Distribution – fake TVTAP download website Note: IP a |
| url | http://ff-de.shutgpt.ir/ | doneplay[.]site/ Distribution – fake TVTAP download website hxxp[:]//ff-de[.]shutgpt[.]ir/ Distribution – fake TVTAP download website hxxp[:]//v |
| url | https://tvtap-hd.app/ | o the Medusa UNKN affiliate ecosystem. IOCs IOC Description hxxps[:]//tvtap-hd[.]app/ Distribution – fake TVTAP download website hxxp[:]//vpn |
| url | http://vpn.askarzadeh.com/ | [.]shutgpt[.]ir/ Distribution – fake TVTAP download website hxxp[:]//vpn[.]askarzadeh[.]com/ Distribution – fake TVTAP download website hxxp[:]//c |
| url | http://vpn.doneplay.site/ | /tvtap-hd[.]app/ Distribution – fake TVTAP download website hxxp[:]//vpn[.]doneplay[.]site/ Distribution – fake TVTAP download website hxxp[:]//f |
From the original article
4 min read at gbhackers.com
A newly uncovered Android banking trojan dubbed RemControl is targeting customers of more than 30 financial institutions across Europe, the Middle East, and Canada. The malware combines fake Google Play pages, Android Accessibility Service abuse, credential-stealing overlays, real-time screen streaming, and remote-control functions to compromise mobile banking sessions. The company tracks the operator behind the […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.