New Android Banking Trojan Uses AI-Built Overlays to Steal Users’ Banking PINs
AI summary · grok-4.7Summaries by Vani AI
RemControl, a new Android banking trojan, uses fake streaming-app downloads and overlays to steal banking PINs.
Group-IB identified RemControl, an Android banking trojan first seen in July 2026, delivered through fake Google Play-style pages for a TV streaming app and geo-filtered in at least one Italian campaign. When a targeted banking app opens, it shows a full-screen overlay that captures PINs, codes, and card details, then hides; operators can log keystrokes, stream screenshots, and control the device after Accessibility access is granted. Matching overlays cover more than 30 banks across Europe, the Middle East, and Canada, with Italy and France the main observed targets. Server notes and a leftover AI-assistant reply indicate an AI tool helped build parts of the platform, while C2 locations are retrieved through Telegram under an affiliate label UNKK.
Key facts
- Group-IB traced RemControl samples first seen in July 2026, mainly in Italy and France.
- Overlays match more than 30 banks in Europe, the Middle East, and Canada.
- It abuses VPN and Accessibility access to capture input and control the phone.
- Operators rotate C2 via Telegram and use a fresh signing certificate per install.
- AI helped build phishing pages; the trojan does not run AI on the device.
- ATT&CK
- T1204.002 Malicious FileT1056.002 GUI Input CaptureT1056.001 KeyloggingT1113 Screen CaptureT1102.001 Dead Drop Resolver
- Products
- Android
- Threat actors
- UNKK
- Malware
- RemControl
- Organizations
- Group-IB
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | bnbnhura.top | //telegram[.]me/+Psyt04xu-cRjMTg0 Telegram dead-drop Domain bnbnhura[.]top RemControl proxy server URL hxxps[:]//definatelynoone[.]c |
| domain | cdn.dlmafi.top | ]askarzadeh[.]com/ Fake TVTap download website URL hxxp[:]//cdn[.]dlmafi[.]top/ Fake TVTap download website URL hxxp[:]//216[.]126[.]2 |
| domain | definatelynoone.com | Domain bnbnhura[.]top RemControl proxy server URL hxxps[:]//definatelynoone[.]com Operator panel URL hxxps[:]//157[.]90[.]179[.]116 Operato |
| domain | ff-de.shutgpt.ir | .]doneplay[.]site/ Fake TVTap download website URL hxxp[:]//ff-de[.]shutgpt[.]ir/ Fake TVTap download website URL hxxp[:]//vpn[.]askarza |
| domain | telegram.me | tvtap-liveapp[.]com/dl.php Final download URL URL hxxps[:]//telegram[.]me/ftestera Telegram dead-drop URL hxxps[:]//telegram[.]me/+ |
| domain | tvtap-hd.app | ompromise (IoCs):- Type Indicator Description URL hxxps[:]//tvtap-hd[.]app/ Fake TVTap download website URL hxxp[:]//vpn[.]doneplay[ |
| domain | tvtap-liveapp.com | ]126[.]229[.]216/ Fake TVTap download website URL hxxps[:]//tvtap-liveapp[.]com/dl.php Final download URL URL hxxps[:]//telegram[.]me/fte |
| domain | vpn.askarzadeh.com | de[.]shutgpt[.]ir/ Fake TVTap download website URL hxxp[:]//vpn[.]askarzadeh[.]com/ Fake TVTap download website URL hxxp[:]//cdn[.]dlmafi[ |
| domain | vpn.doneplay.site | ]//tvtap-hd[.]app/ Fake TVTap download website URL hxxp[:]//vpn[.]doneplay[.]site/ Fake TVTap download website URL hxxp[:]//ff-de[.]shutg |
| ipv4 | 157.90.179.116 | xxps[:]//definatelynoone[.]com Operator panel URL hxxps[:]//157[.]90[.]179[.]116 Operator panel Tracking ID 997470916598588 Meta Pixel |
| ipv4 | 216.126.229.216 | dn[.]dlmafi[.]top/ Fake TVTap download website URL hxxp[:]//216[.]126[.]229[.]216/ Fake TVTap download website URL hxxps[:]//tvtap-live |
| sha256 | 19fef425c3a774e493526126a441a31971db8ac5af84c1d9eef15a272ba02ec1 | d150bb64545e69e792c5ad63578cc3bca5c5b96f2cb Dropper SHA-256 19fef425c3a774e493526126a441a31971db8ac5af84c1d9eef15a272ba02ec1 Dropper SHA-256 54efee2665d3779f1be0d885409e29e6cd07fe944fa |
| sha256 | 1a992e2b36b2a9a77300b0b0fe7e9c20e127c8257fd203bb4b3eaf1e35e63ce7 | f8de9336d0980bbfaf88b1d68be2771b57090d29889 Dropper SHA-256 1a992e2b36b2a9a77300b0b0fe7e9c20e127c8257fd203bb4b3eaf1e35e63ce7 Dropper SHA-256 af2decf5c5cbff0c0460ab09ad3cff497c765e3cf61 |
| sha256 | 28a09cd68b1f4212cc61bd2d44d03d55b8bcd7df284bab56cdae8507abc90e3c | b09ad3cff497c765e3cf61e6c45f4e3b5c6a103312c Payload SHA-256 28a09cd68b1f4212cc61bd2d44d03d55b8bcd7df284bab56cdae8507abc90e3c Payload SHA-256 c6e1235d5cd01a205a191ce48c3d68e9fea620671c0 |
| sha256 | 3b0c49ed1590bceffbefed150bb64545e69e792c5ad63578cc3bca5c5b96f2cb | 334a804dbee5917d6448acb026de4ca818017a04730 Dropper SHA-256 3b0c49ed1590bceffbefed150bb64545e69e792c5ad63578cc3bca5c5b96f2cb Dropper SHA-256 19fef425c3a774e493526126a441a31971db8ac5af8 |
| sha256 | 45e16e56c81059f6758dced28a58256287785a8b0815577c1140293589aa2ae1 | c3ab41bac892c8c79d4a31f5d74c2f3225b629de52e Dropper SHA-256 45e16e56c81059f6758dced28a58256287785a8b0815577c1140293589aa2ae1 Dropper SHA-256 dd6d05ff31f64b9ca8ca9334a804dbee5917d6448ac |
| sha256 | 54efee2665d3779f1be0d885409e29e6cd07fe944fa82e5d6eeb832264c7409d | 126a441a31971db8ac5af84c1d9eef15a272ba02ec1 Dropper SHA-256 54efee2665d3779f1be0d885409e29e6cd07fe944fa82e5d6eeb832264c7409d Dropper SHA-256 cb29b6348ae4458b6b506f8de9336d0980bbfaf88b1 |
| sha256 | 5fff21af95bd38b8c11dd73342a55acb75e91ff1936ed0ccb06af28400ef87d4 | 272f8bfbadc45c0c370c3d7c2ff0c7ffbb015237ce1 Payload SHA-256 5fff21af95bd38b8c11dd73342a55acb75e91ff1936ed0ccb06af28400ef87d4 Payload Note: IP addresses and domains are intentionally de |
| sha256 | 648b34fa952a2806d9f4c272f8bfbadc45c0c370c3d7c2ff0c7ffbb015237ce1 | 60a4f212d949aff27b3a980e6d644c84b0120dd25b3 Payload SHA-256 648b34fa952a2806d9f4c272f8bfbadc45c0c370c3d7c2ff0c7ffbb015237ce1 Payload SHA-256 5fff21af95bd38b8c11dd73342a55acb75e91ff1936 |
| sha256 | 76392303f28a7e6f1463a5fa04a19faf40d51d7be6619943a914482b0f3c7f0b | umeraZZZas Marker used to decode the server address SHA-256 76392303f28a7e6f1463a5fa04a19faf40d51d7be6619943a914482b0f3c7f0b Dropper SHA-256 fa373aaa95ca512ba9595c3ab41bac892c8c79d4a31 |
| sha256 | 77ead085bae72b6cb1c33c55fbd7763c4d8050798c55af3132c3b904084eeb8a | 6c812585e5060a50e38da44bc1a9f67da3921b1a50f Payload SHA-256 77ead085bae72b6cb1c33c55fbd7763c4d8050798c55af3132c3b904084eeb8a Payload SHA-256 ad2b019cf346b8b4e6b2174a95b1d897ce736087bd0 |
| sha256 | 95ec481745c64c385c60f6c812585e5060a50e38da44bc1a9f67da3921b1a50f | ce48c3d68e9fea620671c0c069593027a0218fad5b0 Payload SHA-256 95ec481745c64c385c60f6c812585e5060a50e38da44bc1a9f67da3921b1a50f Payload SHA-256 77ead085bae72b6cb1c33c55fbd7763c4d8050798c5 |
| sha256 | ad2b019cf346b8b4e6b2174a95b1d897ce736087bd06066f31a9d7fd72283e9f | c55fbd7763c4d8050798c55af3132c3b904084eeb8a Payload SHA-256 ad2b019cf346b8b4e6b2174a95b1d897ce736087bd06066f31a9d7fd72283e9f Payload SHA-256 b714f590380e5be8233cd60a4f212d949aff27b3a98 |
| sha256 | af2decf5c5cbff0c0460ab09ad3cff497c765e3cf61e6c45f4e3b5c6a103312c | 0b0fe7e9c20e127c8257fd203bb4b3eaf1e35e63ce7 Dropper SHA-256 af2decf5c5cbff0c0460ab09ad3cff497c765e3cf61e6c45f4e3b5c6a103312c Payload SHA-256 28a09cd68b1f4212cc61bd2d44d03d55b8bcd7df284 |
| sha256 | b714f590380e5be8233cd60a4f212d949aff27b3a980e6d644c84b0120dd25b3 | 74a95b1d897ce736087bd06066f31a9d7fd72283e9f Payload SHA-256 b714f590380e5be8233cd60a4f212d949aff27b3a980e6d644c84b0120dd25b3 Payload SHA-256 648b34fa952a2806d9f4c272f8bfbadc45c0c370c3d |
| sha256 | c6e1235d5cd01a205a191ce48c3d68e9fea620671c0c069593027a0218fad5b0 | d2d44d03d55b8bcd7df284bab56cdae8507abc90e3c Payload SHA-256 c6e1235d5cd01a205a191ce48c3d68e9fea620671c0c069593027a0218fad5b0 Payload SHA-256 95ec481745c64c385c60f6c812585e5060a50e38da4 |
| sha256 | cb29b6348ae4458b6b506f8de9336d0980bbfaf88b1d68be2771b57090d29889 | 885409e29e6cd07fe944fa82e5d6eeb832264c7409d Dropper SHA-256 cb29b6348ae4458b6b506f8de9336d0980bbfaf88b1d68be2771b57090d29889 Dropper SHA-256 1a992e2b36b2a9a77300b0b0fe7e9c20e127c8257fd |
| sha256 | dd6d05ff31f64b9ca8ca9334a804dbee5917d6448acb026de4ca818017a04730 | ed28a58256287785a8b0815577c1140293589aa2ae1 Dropper SHA-256 dd6d05ff31f64b9ca8ca9334a804dbee5917d6448acb026de4ca818017a04730 Dropper SHA-256 3b0c49ed1590bceffbefed150bb64545e69e792c5ad |
| sha256 | fa373aaa95ca512ba9595c3ab41bac892c8c79d4a31f5d74c2f3225b629de52e | 5fa04a19faf40d51d7be6619943a914482b0f3c7f0b Dropper SHA-256 fa373aaa95ca512ba9595c3ab41bac892c8c79d4a31f5d74c2f3225b629de52e Dropper SHA-256 45e16e56c81059f6758dced28a58256287785a8b081 |
| url | http://216.126.229.216/ | xxp[:]//cdn[.]dlmafi[.]top/ Fake TVTap download website URL hxxp[:]//216[.]126[.]229[.]216/ Fake TVTap download website URL hxxps[:]//tvtap-liv |
| url | http://cdn.dlmafi.top/ | :]//vpn[.]askarzadeh[.]com/ Fake TVTap download website URL hxxp[:]//cdn[.]dlmafi[.]top/ Fake TVTap download website URL hxxp[:]//216[.]126[.] |
| url | http://ff-de.shutgpt.ir/ | [:]//vpn[.]doneplay[.]site/ Fake TVTap download website URL hxxp[:]//ff-de[.]shutgpt[.]ir/ Fake TVTap download website URL hxxp[:]//vpn[.]askarz |
| url | https://157.90.179.116 | rver URL hxxps[:]//definatelynoone[.]com Operator panel URL hxxps[:]//157[.]90[.]179[.]116 Operator panel Tracking ID 997470916598588 Meta Pix |
| url | https://definatelynoone.com | dead-drop Domain bnbnhura[.]top RemControl proxy server URL hxxps[:]//definatelynoone[.]com Operator panel URL hxxps[:]//157[.]90[.]179[.]116 Opera |
| url | https://telegram.me/ftestera | hxxps[:]//tvtap-liveapp[.]com/dl.php Final download URL URL hxxps[:]//telegram[.]me/ftestera Telegram dead-drop URL hxxps[:]//telegram[.]me/+Psyt04x |
| url | https://telegram.me/+Psyt04xu-cRjMTg0 | URL hxxps[:]//telegram[.]me/ftestera Telegram dead-drop URL hxxps[:]//telegram[.]me/+Psyt04xu-cRjMTg0 Telegram dead-drop Domain bnbnhura[.]top RemControl pro |
| url | https://tvtap-hd.app/ | ators of compromise (IoCs):- Type Indicator Description URL hxxps[:]//tvtap-hd[.]app/ Fake TVTap download website URL hxxp[:]//vpn[.]doneplay |
| url | https://tvtap-liveapp.com/dl.php | [:]//216[.]126[.]229[.]216/ Fake TVTap download website URL hxxps[:]//tvtap-liveapp[.]com/dl.php Final download URL URL hxxps[:]//telegram[.]me/ftestera |
| url | http://vpn.askarzadeh.com/ | p[:]//ff-de[.]shutgpt[.]ir/ Fake TVTap download website URL hxxp[:]//vpn[.]askarzadeh[.]com/ Fake TVTap download website URL hxxp[:]//cdn[.]dlmafi |
| url | http://vpn.doneplay.site/ | L hxxps[:]//tvtap-hd[.]app/ Fake TVTap download website URL hxxp[:]//vpn[.]doneplay[.]site/ Fake TVTap download website URL hxxp[:]//ff-de[.]shut |
From the original article
4 min read at cybersecuritynews.com
A new Android banking trojan is turning an app download into a banking PIN trap. Called RemControl, it hides behind fake download pages for a television streaming app, then waits for banking apps to open. The campaign uses pages that look like Google Play listings, even though the streaming app is not offered there.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.