RemControl Banking Trojan Gives Attackers Remote Control of Android Devices
RemControl, an Android banking trojan, remotely controls devices and steals credentials from customers of 30-plus banks.
Group-IB describes RemControl, an Android banking trojan that abuses Accessibility Services to remotely control devices and steal PINs, mobile-banking codes, and card expiry dates. It has targeted customers of more than 30 banks across six countries in Western Europe, the Middle East, and Canada since July 2026. Victims are lured by fake Google Play pages impersonating TVTap; a dropper routes Play Protect through a null VPN, signs the payload with a fresh key, and requests Accessibility access for overlays, screen capture, keylogging, and resistance to removal. Operator UNKK, described as Russian-speaking, appears to have used an AI assistant to build portions of the C2 backend and phishing overlays, and stolen data is relayed through a Telegram dead-drop and WebSocket channel.
- RemControl has targeted retail-bank customers since July 2026.
- More than 30 banks across six countries are confirmed targets.
- Fake TVTap Google Play pages deliver a dropper that suppresses Play Protect.
- Accessibility permission enables overlays, screen capture, keylogging, and persistence.
- Russian-speaking operator UNKK reportedly used an AI assistant to build parts of it.
- Threat actors
- UNKKUNKNKonniOpal SleetTA406
- Malware
- RemControlMedusa
- AI models
- Gemini
Coverage
oldest first · one row per article · UTC- · Sep 24, 2026
Help Net SecurityFirst report
New Android malware RemControl steals banking PINs and blocks removal attempts
Group-IB says RemControl, a new Android banking trojan, steals PINs from customers of more than 30 banks.
- · Sep 24, 2026
GBHackers
Hackers Exploit Check Point VPN RCE and Management Zero-Day in Attacks
RemControl Android malware steals banking PINs by targeting over 30 banks in multiple countries.