RemControl Banking Trojan Gives Attackers Remote Control of Android Devices
RemControl, an Android banking trojan, remotely controls devices and steals credentials from customers of 30-plus banks.
Group-IB describes RemControl, an Android banking trojan that abuses Accessibility Services to remotely control devices and steal PINs, mobile-banking codes, and card expiry dates. It has targeted customers of more than 30 banks across six countries in Western Europe, the Middle East, and Canada since July 2026. Victims are lured by fake Google Play pages impersonating TVTap; a dropper routes Play Protect through a null VPN, signs the payload with a fresh key, and requests Accessibility access for overlays, screen capture, keylogging, and resistance to removal. Operator UNKK, described as Russian-speaking, appears to have used an AI assistant to build portions of the C2 backend and phishing overlays, and stolen data is relayed through a Telegram dead-drop and WebSocket channel.
- RemControl has targeted retail-bank customers since July 2026.
- More than 30 banks across six countries are confirmed targets.
- Fake TVTap Google Play pages deliver a dropper that suppresses Play Protect.
- Accessibility permission enables overlays, screen capture, keylogging, and persistence.
- Russian-speaking operator UNKK reportedly used an AI assistant to build parts of it.
- ATT&CK
- T1204.002 Malicious FileT1562.001 Disable or Modify ToolsT1056.001 KeyloggingT1113 Screen CaptureT1102.001 Dead Drop Resolver
- Vendors
- Products
- AndroidGoogle PlayTVTap
- Threat actors
- UNKK
- Malware
- RemControl
- Organizations
- Group-IB
- Countries
- Canada
From the original article
3 min read at infosecurity-magazine.com
The newly-discovered trojan abuses the Android Accessibility Service to gain control over victim devices and collect sensitive banking credentials
By James Coker · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.