Researchers at Group-IB have identified RemControl, a malware-as-a-service platform that leverages malvertising to distribute banking trojans to Android users. The operation impersonates the TVTap IPTV application through counterfeit Google Play pages, with infrastructure operational since at least May and initial malware samples discovered in July.
The campaign focuses on victims in European nations including Italy, France, Spain, Poland, and Portugal, as well as Canada and Middle Eastern countries. Early variants contained over 30 phishing overlays built to harvest banking login information, with at least one Italian deployment employing geofencing and mobile User-Agent verification to target specific users.
One of the overlays incorporates an AI assistant response, suggesting the threat actor utilized AI models during development. The malicious distribution sites embed Meta Pixel tracking identifiers, which Group-IB interprets as evidence that the operator exploited Meta's advertising infrastructure to funnel users toward the malware download locations.
Technical capabilities and infection chain
Upon execution, the dropper initiates a VPN service that filters out Google Play services traffic, disabling the real-time malware detection features of Play Protect. This blocking technique has also appeared in recent builds of ToxicPanda, a larger operation that deploys phishing overlays targeting 349 banking, financial, cryptocurrency, and e-wallet applications across 16 countries.
The malware requests Accessibility Service permissions during the installation process. Once granted, RemControl gains the ability to execute a comprehensive set of malicious functions.
- Render full-screen phishing overlays atop legitimate banking applications to intercept PINs, banking codes, card expiration dates, and login credentials
- Fetch new banking targets dynamically from command-and-control servers
- Stream real-time screenshots and the complete Android accessibility and UI tree to the attacker
- Log clicks, text input changes, focus shifts, and other user interactions within applications
- Execute remote taps, swipes, scrolling, gestures, extended presses, and text entry
- Extract Android pattern-lock coordinates from multiple manufacturers, including Samsung, Xiaomi, Huawei, OPPO, OnePlus, and standard Android devices
- Resist uninstallation by detecting when users access application management, accessibility settings, or factory reset options and automatically terminating before removal
RemControl retrieves encrypted command-and-control details from Telegram channels, allowing the operator to swap out infrastructure rapidly if systems become compromised or disrupted.
Attribution and infrastructure
Group-IB uncovered exposed FastAPI documentation within the initial command-and-control proxy, which exposed the API endpoints the malware uses to obtain banking overlays and transmit stolen credentials.
The threat actor's origin remains uncertain, though researchers discovered Russian language text embedded in HTML files of certain overlays, pointing to a Russian-speaking individual as the creator of at least portions of the malware. Using a shared identifier discovered across analyzed samples, Group-IB designates the operator as UNKK and theorizes a possible link to the Medusa banking trojan.
Recommended defenses
- Refrain from installing APK files from sources outside Google Play unless the publisher is explicitly recognized and trusted
- Run regular Play Protect scans to detect known malware
- Decline Accessibility Service permission requests from applications that do not genuinely require such permissions for accessibility functionality