RemControl Turns Fake IPTV Downloads Into Full Android Banking Surveillance

A newly identified Android malware-as-a-service operation is combining banking credential theft with live surveillance and remote device control. Named RemControl, the malware reaches victims through counterfeit Google Play pages advertising the TVTap IPTV application.

Group-IB reported the campaign on September 23, 2026. Its infrastructure has been operating since at least May, while the first analyzed malware samples were found in July.

The activity targets Android users across parts of Europe, Canada, and the Middle East. Once installed and granted Accessibility Service permissions, RemControl can display banking phishing overlays, monitor user input, capture device-unlock patterns, and let an operator interact with the infected phone remotely.

Fake TVTap pages filter visitors and deliver the APK

RemControl’s distribution chain relies on malicious advertising and download pages designed to resemble Google Play listings for TVTap. These pages are imitations; the malware is delivered as an APK rather than through a confirmed legitimate Play Store listing.

Identified targets include users in:

• Italy
• France
• Spain
• Poland
• Portugal
• Canada
• Countries in the Middle East

At least one campaign aimed at Italy checked both a visitor’s location and mobile User-Agent. This combination allows the operators to restrict delivery to selected regions and device types, reducing exposure to researchers, automated scanners, and people outside the intended victim pool.

The malicious pages also contained Meta Pixel tracking IDs. Their presence suggests the operators may have used or abused Meta’s advertising ecosystem to measure visits or route mobile users toward the counterfeit download pages. It does not establish that Meta knowingly hosted or approved the malware.

The first RemControl samples included more than 30 phishing overlays designed to imitate banking interfaces. These screens can appear over legitimate financial applications and collect information entered by the victim.

One overlay contained a response produced by an AI assistant. Group-IB considers this a strong sign that generative AI contributed to development or content preparation. It does not prove that an AI system created the malware as a whole.

A local VPN interferes with Google Play Protect

The initial dropper launches a VPN service that blocks traffic to Google Play services. By disrupting those connections, RemControl prevents Google Play Protect from conducting real-time checks against known malicious applications.

This technique is especially relevant because users may believe Play Protect remains available while the malware is actively preventing it from reaching the services needed for verification. The VPN component therefore supports evasion before the main credential-theft and surveillance functions begin.

Group-IB has observed similar traffic blocking in a recent version of ToxicPanda, another Android banking malware operation. ToxicPanda’s overlays target 349 banking, financial, cryptocurrency, and digital-wallet applications across 16 countries.

That technical overlap does not, by itself, establish common ownership or shared developers. It does show that blocking security-service traffic is becoming part of the operating model for sophisticated Android financial malware.

No formal vulnerability identifier or CVSS score has been assigned to RemControl. It is malware rather than a disclosed software flaw, so there is no identified CVE or associated CISA Known Exploited Vulnerabilities deadline. The affected Android versions have not been disclosed.

Accessibility access unlocks surveillance and remote control

RemControl asks the victim to approve Android Accessibility Service access during installation. This permission is central to the attack because it gives the malware extensive visibility into application interfaces and user actions.

After approval, RemControl can place full-screen phishing windows over legitimate banking applications. These overlays are designed to collect PINs, account credentials, banking codes, and card expiration dates.

The malware is not limited to a fixed set of targets embedded in its APK. It can retrieve additional banking targets dynamically from its command-and-control infrastructure, allowing operators to modify campaigns without distributing a completely new application.

RemControl can also transmit screenshots and the full Android accessibility or UI tree to the operator in real time. The UI tree exposes the structure and content of interface elements, giving the attacker more precise information than screenshots alone.

Its monitoring capabilities cover clicks, changes to text fields, shifts in interface focus, and other input events across applications. In parallel, the operator can issue remote commands for:

• Taps and swipes
• Scrolling and other gestures
• Long presses
• Text injection

This creates an interactive remote-access channel. An operator can observe what the victim sees, collect entered information, and manipulate the interface rather than relying only on automated credential harvesting.

RemControl can additionally capture pattern-lock coordinates on Samsung, Xiaomi, Huawei, OPPO, OnePlus, and stock Android devices. That capability could expose a device-unlock secret through the victim’s normal interaction with the screen.

Anti-removal controls trap users outside security settings

The malware watches for attempts to reach settings that could expose or disable it. If a victim opens application-management controls, Accessibility Service settings, or factory-reset options, RemControl can automatically close those screens.

This behavior complicates manual cleanup. A user may recognize the malicious application yet remain unable to revoke its permissions or reach the controls needed to remove it.

The combination is more dangerous than a conventional overlay attack. RemControl can interfere with security checks, collect financial credentials, observe activity across applications, control the interface, and obstruct remediation from the same compromised device.

Victims may therefore face more than the theft of a single password. The operator can watch an active banking session and collect several pieces of authentication data as they appear.

Telegram helps operators rotate command infrastructure

RemControl obtains encrypted command-and-control information from Telegram channels. This design gives operators a mechanism for publishing replacement infrastructure when an existing server is blocked or taken offline.

Investigators also found exposed FastAPI documentation on the initial C2 proxy. The documentation revealed endpoints used to retrieve banking overlays and submit stolen credentials, offering a partial view of the backend workflow.

Group-IB tracks the operator as UNKK, based on an identifier shared across analyzed samples. The researchers suspect a possible relationship with the Medusa banking trojan, but that connection remains unconfirmed.

Some overlay HTML files contain Russian-language material, indicating that at least one person involved in development may speak Russian. This is not enough to establish the operator’s nationality, location, or affiliation.

No confirmed identity or origin has been disclosed.

Android users should treat unexpected accessibility prompts as a warning

Users should avoid APK files distributed through advertisements, redirects, or unofficial TVTap download pages. An application presented with Google Play styling is not necessarily hosted by Google Play.

Google Play Protect should remain enabled, with regular scans performed where possible. However, RemControl’s network-blocking behavior means that an apparently enabled setting does not guarantee successful real-time checks after infection.

Accessibility requests deserve particular scrutiny. IPTV and media-streaming applications ordinarily need a clear, legitimate explanation before receiving permission to monitor interface events or control on-screen actions. Users should reject unexplained requests.

Banking credentials should never be entered into screens reached through untrusted advertisements or unexpected overlays. Full-screen prompts appearing immediately after installing an unofficial APK should be treated as potentially hostile.

Organizations managing Android fleets can look for:

• Unauthorized Accessibility Service activation
• VPN components that interfere with Google Play services
• Overlay behavior targeting banking or financial applications
• Attempts to prevent access to application-management or reset settings
• Network configurations obtained through Telegram-based C2 mechanisms

Specific file hashes, package names, domains, and C2 addresses have not been identified here, limiting indicator-based detection. Behavioral monitoring is therefore particularly useful: the combination of sideloading, Accessibility abuse, local VPN activity, and settings interference offers a stronger signal than any one action alone.