RemControl Malware Emerges as AI-Driven Threat to Android Users
A new Android malware-as-a-service (MaaS) platform named RemControl has been observed targeting users in Europe and Canada through malvertising campaigns that impersonate the TVTap IPTV application. First detected in July 2026, the malware’s infrastructure has been active since at least May of the same year, according to cybersecurity researchers at Group-IB. The initial samples contained more than 30 phishing overlays designed to mimic legitimate banking and financial applications in order to steal user credentials.
Geographic Targeting and Distribution Tactics
RemControl specifically targets users in Italy, France, Spain, Poland, and Portugal within Europe, as well as users in Canada and several countries in the Middle East. The malware is distributed via fake Google Play pages that closely resemble the legitimate TVTap IPTV app. At least one campaign observed in Italy employed geofencing and mobile User-Agent checks to refine its targeting. These malicious landing pages were found to include Meta Pixel tracking IDs, suggesting that the threat actors abused Meta’s advertising ecosystem to direct potential victims to the fraudulent download sites.
Technical Capabilities and Evasion Techniques
Upon installation, the RemControl dropper initiates a VPN service that blocks traffic from Google Play services. This action prevents Google Play Protect from conducting real-time scans against known malware signatures, a technique previously observed in the ToxicPanda malware family. During the installation process, the malware requests Accessibility Service permissions. If granted, it gains extensive control over the infected device, enabling a wide range of malicious activities.
Functionality of the Accessibility Service Abuse
With Accessibility Service permissions, RemControl can display full-screen phishing overlays on top of legitimate banking applications to capture PINs, banking codes, card expiration dates, and login credentials. It dynamically receives updated banking targets from its command-and-control (C2) infrastructure. The malware streams screenshots and the complete Android accessibility/UI tree to the operator in real time. It records user interactions such as clicks, text changes, and focus events across applications. Additionally, it can remotely perform taps, swipes, scrolling, gestures, long presses, and text injection. The malware is also capable of capturing Android pattern-lock coordinates across multiple OEMs, including Samsung, Xiaomi, Huawei, OPPO, OnePlus, and stock Android devices.
To hinder removal, RemControl monitors for attempts to access application-management, accessibility, or factory-reset settings. When such actions are detected, the malware automatically exits these screens to prevent uninstallation.
Command-and-Control Infrastructure and AI Indicators
RemControl retrieves encrypted C2 information from Telegram channels, allowing the operators to rotate infrastructure dynamically in response to takedowns or disruptions. Researchers at Group-IB discovered exposed FastAPI documentation in the initial C2 proxy, which revealed the endpoints used to fetch banking overlays and submit stolen credentials. One of the phishing overlays analyzed by the team displayed an AI-generated assistant response, providing strong evidence that large language models were used in the development of at least some components of the malware.
Attribution and Links to Other Threats
The origin of the threat actor behind RemControl remains unclear. However, Russian language strings were identified in the HTML files of certain phishing overlays, indicating that a Russian-speaking individual likely contributed to the development of those components. Based on a shared identifier across analyzed samples, Group-IB tracks the operator under the designation UNKK and suspects a possible connection to the Medusa banking trojan.
Recommendations for Users
Android users are advised to refrain from downloading APK files from sources outside the Google Play Store unless they explicitly trust the publisher. Enabling regular Play Protect scans and rejecting Accessibility Service permission requests from applications that do not legitimately require them for accessibility functions are critical defensive measures. Users should remain vigilant against apps that request excessive permissions or mimic legitimate services through deceptive branding.
Source: BleepingComputer