On September 23, 2026, Group-IB published a technical analysis of RemControl, an Android banking trojan distributed through fake pages posing as Google Play and the IPTV app TVTap. The reported installation chain interferes with Google Play Protect checks; after a user grants Android Accessibility access, the malware can place fake screens over targeted banking apps and collect credentials.
Group-IB documented RemControl as Android banking malware
RemControl is a banking trojan distributed through pages that impersonate Google Play and TVTap, a third-party IPTV app. The pages lead users to an unofficial download. A dropper then installs the malware and requests access to Android’s Accessibility Service, which lets apps interact with on-screen content and controls.
How the installation chain interferes with Play Protect
During installation, the dropper uses a local VPN service to block traffic from the Google Play Store. That interference hinders Play Protect’s real-time checks. The dropper also creates a new signing key in Android Keystore for each installation before signing the payload.
The sequence matters: the VPN interference happens during installation, while the request for Accessibility access comes before RemControl can use the capabilities described in the analysis.
What RemControl can do with Accessibility access
Once access is granted, RemControl can place a full-screen phishing overlay over a targeted banking app and use it to collect information such as banking PINs, mobile banking codes and card expiry dates. It can also stream screen images and accessibility data, log clicks and text changes, and send remote taps, swipes, gestures or text.
The malware can also react when a user opens settings for app management, Accessibility or a factory reset, dismissing those screens with a back-navigation action.
The banking-app targets documented in the report
Group-IB identified more than 30 banking-app overlay targets across Italy, France, Spain, Poland, Portugal, Canada and some member states of the Gulf Cooperation Council (GCC). The figure counts targeted banking-app overlays; the country list describes the apps RemControl was configured to target.
Infrastructure, operator tag and AI-development artifacts
Group-IB described RemControl as a Malware-as-a-Service platform. Its operator panel included affiliate tracking, device management, overlay tools and APK-building functions, giving affiliates access to shared infrastructure.
RemControl retrieves encrypted command-and-control server information from Telegram channel content, a technique known as a dead drop. Changing the concealed server address can redirect infected devices without rebuilding the malware. WebSocket is the main communication channel, with HTTP POST as a fallback.
Group-IB identified the tag UNKK in the first observed campaigns. Similarities in naming, Telegram dead drops and geographic targeting suggested a possible connection to Medusa’s UNKN affiliate botnet. The analysis also described artifacts consistent with AI-assisted development in parts of the infrastructure, including assistant-generated text found in a production phishing overlay.
