Group-IB published its analysis on September 23, 2026, and BleepingComputer reported it the same day. Both accounts describe the same delivery chain and targets. If you own an Android phone, or manage Android devices through an enterprise mobility management (EMM) platform, the useful details are how the dropper stops Google Play Protect from checking it and how much control Accessibility access gives the operator.
RemControl Hides Behind a Fake TVTap Download
Group-IB researchers say they have discovered a previously undocumented Android banking trojan, internally named RemControl by its operator, targeting retail banking customers across Western Europe, the Middle East, and Canada. The company describes it as a Malware-as-a-Service platform, with first observed samples dating to July 2026 and infrastructure active since May 2026. Under the malware-as-a-service model, one developer builds and maintains the trojan and rents it to other criminals, called affiliates, who run their own campaigns.
Group-IB lists more than 30 confirmed phishing overlay targets covering retail banking applications across Italy, France, Spain, Poland, Portugal, Canada, and some GCC member states. GCC stands for the Gulf Cooperation Council. Neither Group-IB nor BleepingComputer has published victim counts or loss figures. The list names countries whose banking apps are targeted. It does not show how many infections occurred in those countries.
The bait is a pirate-TV app. RemControl is distributed through fake Google Play Store pages impersonating the TVTap IPTV application, with malvertising campaigns confirmed as one of the delivery channels. BleepingComputer adds that at least one Italian campaign used geofencing and mobile User-Agent checks. In practice, the fake store page can show its payload only to visitors from the right country using a phone browser, which makes the page harder for desktop scanners and researchers to spot.
The fake pages also carry Meta Pixel tracking IDs, which Group-IB sees as a hint that the operator abused Meta's advertising ecosystem to drive victims to the download pages. That is a researcher's inference from tracking code. It does not show that Meta knowingly ran or approved any particular ad, and nobody has said how many ads ran.
The dropper may soon speak more languages than the current target list suggests. Group-IB found that it supports over 30 languages, suggesting the operator may expand campaigns beyond currently observed geographies in the future. A dropper is the first-stage app that installs the actual trojan. The current country list is therefore a snapshot and may grow.
RemControl Blocks Google Play Protect Before It Asks for Accessibility
RemControl's installer first stops Google's malware checks from working. According to BleepingComputer, when launched, the dropper starts a VPN service that blocks traffic from Google Play services, preventing Play Protect from performing real-time checks against known malware. Android lets apps set up a local VPN, which is normally used by firewalls and ad blockers. RemControl uses that feature to cut Play services off from Google's servers while the payload is installed.
Group-IB describes a second evasion layer. The dropper generates a unique signing certificate per installation to defeat hash and certificate-based detection. Every Android app is signed with a certificate, and security tools often flag known-bad apps by that certificate or by the file's hash. If every install is signed differently, a blocklist built from one victim's sample may not match the next victim's copy.
RemControl did not invent the VPN trick. BleepingComputer notes that the feature has also been observed in a recent version of the ToxicPanda malware, a much bigger operation that uses phishing overlays for 349 financial, cryptocurrency, and digital wallets applications used in 16 countries. The shared technique does not show that the two operations are connected, and neither source claims they are.
This matters because Play Protect is the protection most Android users rely on for sideloaded apps. In its Android Enterprise documentation, Google says Play Protect scans every app at install time and also runs periodic device scans. It covers apps from outside the Play Store: the page says Play Protect "scans all installed apps on the device including apps that were either sideloaded or installed through an EMM." Google also describes a warning for apps downloaded from browsers, messaging apps or file managers that request sensitive permissions, which Play Protect can block automatically. RemControl's VPN step appears designed to disable those checks while installation is happening.
Here is our inference, based on how Google describes Play Protect rather than on anything Group-IB tested. Periodic scans run after the VPN block ends, and a per-install certificate does not stop behaviour-based detection, so Play Protect may still catch RemControl later. Still, Play Protect should be treated as one layer of defence, not a guarantee.
What Accessibility Access Gives the RemControl Operator
Everything dangerous in RemControl depends on one approval from the user. BleepingComputer reports that during installation, the malware requests approval for Accessibility Service permissions. Android's Accessibility Service exists to help people with disabilities. It lets an app read what is on screen and act on the user's behalf, such as reading text aloud or controlling the phone by voice. That same access lets malware watch and control the whole device.
Group-IB summarizes what the operator gets: the malware abuses Android's Accessibility Service to inject phishing overlays over legitimate banking applications, stream the device screen in real time, log keystrokes, and provide the operator with full remote control over infected devices. BleepingComputer's list of capabilities after the permission is granted is more detailed:
- RemControl can show full-screen phishing overlays on top of real banking apps and capture PINs, banking codes, card expiry dates and login credentials.
- It can receive new banking targets from its command-and-control (C2) servers at any time, so the target list is not fixed at install.
- It streams screenshots and the full Android accessibility/UI tree (a structured description of everything on screen) to the operator in real time.
- It records clicks, text changes, focus events and other input across all apps.
- The operator can remotely tap, swipe, scroll, perform gestures and long presses, and type text.
- It captures pattern-lock coordinates on Samsung, Xiaomi, Huawei, OPPO, OnePlus and stock Android devices.
- It resists removal by detecting when the victim opens app management, Accessibility settings or factory-reset screens, and leaving those screens automatically.
Taken together, these features let the operator commit fraud on the victim's own phone. The overlays capture credentials. Remote control and text injection let the operator use those credentials in the real banking app on the real device. A stolen pattern lock lets the operator unlock the phone when the owner is not using it. The public reports do not say which Android versions are affected or whether every feature was shown working on every listed manufacturer.
The anti-removal feature is the one most likely to confuse victims. The malware leaves the settings screens a user would open to uninstall it, which makes ordinary cleanup attempts fail. The reports describe this as interference, not as making removal or a factory reset impossible.
Telegram Dead Drops and an Exposed FastAPI Panel Reveal RemControl's Infrastructure
RemControl is built to survive takedowns. BleepingComputer reports that the malware fetches encrypted C2 information from Telegram channels, so the operator can switch servers when one is shut down. This setup is known as a dead drop. If a server is seized or blocked, the operator posts a new encrypted address to the channel and infected phones reconnect to it. Removing one domain from the network is not enough to cut infected phones off.
The operator also made a basic operational mistake. Group-IB found FastAPI documentation exposed in the initial C2 proxy that revealed the endpoints the malware used to fetch banking overlays and to submit stolen credentials. FastAPI is a Python web framework that generates interactive API documentation automatically unless the developer turns it off. Group-IB says the leak went beyond two endpoints: it revealed the full command set, overlay management system, affiliate tracking, and build infrastructure.
The affiliate tracking and build system match the malware-as-a-service model. The operator runs a panel where affiliates build their own droppers, and the operator tracks which affiliate brought in which victims. For defenders, the leaked panel gave researchers an unusually complete view of how the service works. Neither public account includes domains, IP addresses or other indicators of compromise, so defenders should not treat the reporting as a detection feed.
AI Traces on RemControl's Overlays, and the Possible Medusa Link
Group-IB's headline says AI built the overlays, and there is evidence behind the claim. BleepingComputer reports that in one of the overlays, the malware displays an AI assistant response, a strong indication that it has been built with the help of AI models. In other words, a fake banking page shipped with an AI chatbot's reply still in it, which shows the developer pasted generated content without reading it closely.
The OffSeq threat feed, summarizing Group-IB's research, adds detail on how the developers may have gotten that help. It says the C2 panel documentation describes credential theft as quiz completion, suggesting developers deceived AI assistants into building fraud infrastructure under false pretenses. That fits Group-IB's description of the infrastructure as unknowingly built by AI, which means the AI tools did the work without knowing what it was for. The evidence covers phishing pages and panel infrastructure. Neither source names the AI service or claims the trojan's Android code was written by a model.
Attribution is less certain. The researchers found Russian-language text in the HTML of some overlays, which BleepingComputer says points to a Russian speaker developing at least some of them. That is a clue about the author of some files, not a finding about the operator's nationality. Group-IB tracks the operator as UNKK, based on an identifier shared across the samples it analyzed. It suspects a link to the Medusa banking trojan, which OffSeq describes as possible links to the Medusa UNKN affiliate botnet based on overlapping infrastructure patterns and naming. That is a researcher's assessment, not a confirmed attribution. It also suggests RemControl may come from people with experience running Android banking fraud, not from newcomers.
What RemControl Means for Android Users and Device Managers
For individuals, the decision is straightforward. Do not install TVTap, or any IPTV app, from a web page, even one that looks like Google Play. Treat any Accessibility permission request from an app that is not an accessibility tool as a warning sign. Those two decisions would have stopped every RemControl infection chain described so far.
To check that Play Protect is working, open the Google Play Store app, tap your profile icon at the top right, then go to Play Protect and Settings. Make sure Scan apps with Play Protect is turned on. Google's help page also recommends turning on Improve harmful app detection if you have installed apps from outside the Play Store. It says to install current Android security updates and Google Play system updates, and to uninstall apps you do not need, do not trust or did not get from the Play Store.
If you think a phone is already infected, remember that RemControl leaves the app-management and Accessibility screens on its own. If you cannot stay on those screens long enough to remove an app, Google's malware guidance says you may need to reset the device or ask the manufacturer for help. Because the malware captures banking credentials and codes, contact your bank from a separate, clean device. Neither report gives a RemControl-specific cleanup procedure.
For IT administrators, Google's Android Enterprise documentation says that with an EMM (the category that includes Microsoft Intune), admins can require Play Protect on managed devices and receive alerts when a potentially harmful app is found. RemControl's VPN trick is a reason to enforce that setting, not a reason to skip it. Where your EMM policy allows it, also restrict installs from unknown sources on managed devices. Personal-profile apps on work-profile phones remain the user's responsibility.
- RemControl reaches victims through malvertising and fake Google Play pages for the TVTap IPTV app, so any app installed from a browser download is suspect.
- The dropper uses a local VPN to block Google Play services during installation and signs each install with a unique certificate to avoid blocklists.
- The trojan's overlays, screen streaming, keylogging, remote control and pattern-lock capture all depend on the user granting Accessibility Service access.
- Group-IB lists more than 30 targeted banking apps in Italy, France, Spain, Poland, Portugal, Canada and some Gulf states, and the dropper's 30-plus languages suggest that list could grow.
- Scan apps with Play Protect should be on for every user, and managed fleets should enforce it through their EMM and route harmful-app alerts to the security team.
- If a phone keeps leaving the app-management or Accessibility screens, stop using it for banking, contact your bank from another device and plan on a reset.
RemControl shows how much of a working Android banking fraud service can now be assembled from rented or AI-generated parts: Meta ad tracking, Telegram dead drops, FastAPI panels and AI-written phishing pages. The operator's mistakes gave Group-IB an early, detailed look at the service. The Telegram-based fallback means the service will likely keep running after individual servers are taken down, and the multilingual dropper suggests more countries' banks could be targeted. For now, the most reliable defences are the ones every victim had to get past: a download from outside the Play Store and an Accessibility prompt that should have been denied.