RemControl Android Trojan Uses Fake TVTap Pages to Steal Banking Credentials
Summary
Group-IB reports that RemControl targets customers of more than 30 banks via fake TVTap app pages. The Android trojan abuses VPN and Accessibility permissions to steal credentials and control devices; a possible link to UNKN remains unconfirmed.
Key points
- Fake pages impersonating the TVTap IPTV app distribute RemControl; an Italian campaign used six sites that served the app to mobile devices with Italian IP addresses.
- The dropper uses a VPN to block Google Play Store traffic and hinder Play Protect scanning, then installs the malware and requests Accessibility Service permission.
- RemControl can overlay banking apps with fake login screens, capture PINs and banking codes, record typed text, and send screenshots to attackers.
- It can also capture Android lock-screen patterns and redirect victims away from settings used to uninstall the malware, revoke permissions, or factory-reset the device.
- The malware retrieves its C2 address from encrypted text in public Telegram channels; per-install signing certificates and newer versions’ custom code packer complicate detection.
- Group-IB says the malware targets customers of more than 30 banks across several European countries, Canada, and Gulf states, and reports signs of malware-as-a-service and AI-assisted development.
- Researchers track the operator as UNKK and note similarities to UNKN, a Medusa affiliate, but say the available evidence does not establish a definitive link.
Article Details
- Attack Vectors
- Fake Google Play pages impersonating the TVTap IPTV app distribute the RemControl dropper.
- The dropper requests permission to start a VPN service and blocks Google Play Store network traffic to prevent Google Play Protect from scanning the installation.
- The dropper requests Accessibility Service permission, which RemControl abuses to control the device, capture input and screen content, and interfere with removal.
- Fake banking login screens overlay targeted banking apps to steal PINs, mobile banking codes, and card expiry dates.
- Defensive Notes
- Obtain Android apps from trusted sources and treat pages impersonating Google Play as suspicious.
- Review VPN and Accessibility Service permissions granted to apps, especially apps posing as TV or IPTV updates.
- Be alert to apps that block Google Play Store network traffic or redirect users away from app-removal, permission-management, or factory-reset settings.
MITRE ATT&CK
T1417The malware records clicks and typed text and captures banking PINs and codes through fake login screens.T1444The RemControl dropper is presented as a fake TVTap update and is distributed through pages impersonating the app.T1453RemControl abuses Android Accessibility Service permission to control the device and interfere with malware removal.T1513RemControl sends live screenshots to the attackers and captures the lock-screen pattern grid.
Threat Actors
Malware
Products
AndroidRemControl is a new Android banking trojan that lures victims with fake TVTap app pages, then abuses permissions to take over devices and steal banking PINs and other sensitive data.Google Play ProtectThe malware uses Accessibility Service and VPN abuse to gain control and evade Google Play Protect.Google Play Store“RemControl spreads through fake Google Play Store pages impersonating the TVTap IPTV application.TVTapRemControl is a new Android banking trojan that lures victims with fake TVTap app pages, then abuses permissions to take over devices and steal banking PINs and other sensitive data.
Countries
CanadaIt targets banking customers in Italy, France, Spain, Poland, Portugal, Canada, and Gulf states.FranceIt targets banking customers in Italy, France, Spain, Poland, Portugal, Canada, and Gulf states.ItalyIt targets banking customers in Italy, France, Spain, Poland, Portugal, Canada, and Gulf states.PolandIt targets banking customers in Italy, France, Spain, Poland, Portugal, Canada, and Gulf states.PortugalIt targets banking customers in Italy, France, Spain, Poland, Portugal, Canada, and Gulf states.SpainIt targets banking customers in Italy, France, Spain, Poland, Portugal, Canada, and Gulf states.