New Android malware RemControl steals banking PINs and blocks removal attempts
Group-IB says RemControl, a new Android banking trojan, steals PINs from customers of more than 30 banks.
Group-IB identified RemControl, an Android banking trojan distributed through fake Google Play pages impersonating the TVTap IPTV app, with first VirusTotal samples submitted on July 19, 2026. It targets customers of more than 30 banks in Italy, France, Spain, Poland, Portugal, Canada, and some Gulf states, including an Italian campaign limited to Italian IP addresses and promoted with Meta ads. After the victim grants VPN and Accessibility permissions, it blocks Play Protect, signs each payload with a unique certificate, overlays banking apps to steal PINs and card data, captures the screen and keystrokes, and blocks uninstallation. Command-and-control addresses are hidden in public Telegram channels, the backend documentation suggests AI-assisted development, and Group-IB tracks the operator as UNKK with a possible link to Medusa affiliate UNKN.
- RemControl impersonates TVTap and is hosted on fake Google Play pages.
- It targets customers of more than 30 banks across Europe, Canada, and Gulf states.
- Accessibility permission enables overlays, screenshots, remote control, and removal blocking.
- C2 locations are posted in public Telegram channels; it is sold as a service.
- Group-IB tracks operator UNKK and notes a possible Medusa affiliate connection.
- ATT&CK
- T1204.002 Malicious FileT1056.001 KeyloggingT1113 Screen CaptureT1102.001 Dead Drop ResolverT1562.001 Disable or Modify Tools
- Products
- AndroidTVTapGoogle PlayTelegram
- Malware
- RemControlMedusa
- Organizations
- Group-IB
From the original article
3 min read at helpnetsecurity.com
A new Android banking trojan called RemControl tricks victims into installing a fake TV app, then takes control of their phones to steal banking PINs, Group-IB has found. Researchers confirmed that the malware targets customers of more than 30 banks in Italy, France, Spain, Poland, Portugal, Canada and some Gulf states. The first samples were submitted to VirusTotal on July 19, 2026.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.