RemControl Android Trojan Steals Banking PINs From 30 Banks and Shuts Down Google Play Protect

Your banking PIN went out live while your thumb was still on the keypad. Your pattern lock too. More than 30 banks. Europe, Canada and the Gulf. One free TV app from a page that looked like the store.

It began with an advertisement.

Someone in Italy, France, Spain, Poland, Portugal, Canada or one of the Gulf states tapped a promoted post for a free TV app. It led to a page that copied the official store down to the buttons. That page was picky about who it let in. It looked at what you were holding and where you were sitting. A phone in Italy got the Italian campaign. A computer got a blank page.

The app on offer was TVTap, a player for television channels it holds no license for. It has never been in the official store and it never will be, so the people who want it are used to fetching it from somewhere else. That habit is what the operators count on. It is the reason this lure works where a fake banking app would not.

Group-IB took the campaign apart and published what they found this week. The malware has no public name yet, so researchers use the one its own operator wrote into the code: RemControl. And it is for rent. Each build carries a tag that says which affiliate it belongs to and which country it works in: IT-NEW and IT-NEW4, FR-NEW and FR-NEW4, pt-v3, ARABIC2 and ARABIC3.

The first thing that lands on the phone is a small installer app, showing an update screen for that same TV player. The banking trojan comes later. That installer does three things, and the first one is the part I had not seen before.

• → It asks permission to set up a VPN, then builds one that leads nowhere. Google Play Protect is the scanner Android runs over an app while it installs. Its traffic goes into that empty tunnel and never comes out the other side. Play Protect is still running. It has nothing left to talk to. That same trick has turned up before, in a recent version of ToxicPanda, a far bigger operation with overlays for 349 banking, crypto and wallet apps across 16 countries.
• → Apps carry a signature, and scanners look for signatures they have seen before. So the installer makes a brand new one on the spot, in the Android Keystore, and signs the payload with it. Two phones infected an hour apart end up with two different signatures. Searching for a known file gets you nothing. On the newer builds the code inside that payload sits encrypted too, with the key worked out from the certificate that was made a moment earlier. Hand an analyst the file on its own and he cannot open it. He needs the certificate off that one phone.
• → It installs the payload through Android’s session-based package installer, and that choice is deliberate.

That third step gets past a restriction Google added in Android 13. It is called Restricted Settings, and the thinking behind it was sound. An app you install yourself, from outside a store, is not allowed to switch on the Accessibility Service. That one permission is what almost all banking malware is after, so Google blocked it for sideloaded apps.

Android tells a store app apart from one you installed yourself by the way it arrived. Stores install through something called the session-based installer. Sideloaded apps normally do not.

So the operators used it too. They sideload the installer, and that installer puts the payload on the phone the way a store would. As far as the system can tell that payload came from a store, so it gets to ask for accessibility.

This route is not fresh either. ThreatFabric documented it in November 2023, in a dropper-as-a-service called SecuriDropper, and wrote it down in plain words: stores use the session-based method and sideloads do not. Three years on, the same method still works.

Group-IB does not say which Android versions this hits. Android 13 and 14 have that restriction as it was first written, and that is the one this trick gets past. Android 15 put something on top of it, Enhanced Confirmation Mode, which works off an allowlist that ships in the factory image at /system/etc/sysconfig. On 13 and 14 this trick works. What it does on 15, no research has answered yet.

Then comes the permission dialog.

The Accessibility Service is there for people who cannot see the screen well, or who cannot use their hands the way an app expects. To do that work it has to read what is on the screen, know which app is in front, and tap and type on your behalf. That is the same list an attacker would write if he could ask for anything he wanted. Android hands it over on one toggle.

From that toggle onward:

• → RemControl watches which app comes to the foreground. A banking app appears, and a full-screen web page drops over the top of it. The phone never stores that fake screen. It pulls it from the server the moment it is needed, at /overlay/{result_id}. Take the device apart afterwards and you find no phishing page at all. They have one ready for more than 30 banks.
• → Android has a built-in way to grab whatever is on the screen: takeScreenshot(), added in Android 11 at API level 30 so accessibility apps could use it. It makes no sound and leaves nothing on the screen. RemControl uses it as a camera, encodes the frames as WEBP and ships them out.
• → Alongside each frame it sends the accessibility tree as JSON. The operator reads which box is the PIN field and which button confirms it, straight out of the app’s own layout.
• → It logs clicks, text changes, focus changes and selections across the apps on the phone.
• → It recognises the pattern lock screen on ten of the most common Android builds, among them stock AOSP, Samsung One UI, Xiaomi MIUI, Huawei, OPPO ColorOS and OnePlus. Then it records the grid that gets drawn.
• → It sends input back the other way: taps, long presses, swipes, scrolls, gestures and typed text. The operator can work the phone while it lies face down on a table.
• → He also decides which apps still get online. One command, set_app_blocklist, and your banking app is cut off from the network until it suits him.
• → Another command, change_udid, swaps the identifier the phone reports back. An infected device drops off his own list and comes back as a new one.

And when the owner starts to suspect something, he cannot reach the settings. RemControl watches, in more than 30 languages, for any move towards app management, the accessibility settings or a factory reset. The moment one of those screens comes up it fires a back action, and the screen is gone before a finger reaches it.

The commands come in over Telegram. Two channel links sit in the code. RemControl opens that channel page, hunts through the HTML for a marker word, and grabs whatever sits between two copies of it. What comes out is Base64, and under the Base64 sits AES-128-CBC encryption. The key and the starting value both come out of a SHA-256 hash of that same marker word, so the configuration carries its own key. Edit the Telegram post and the malware follows you to a new server. The marker found in the samples:

1

numeraZZZas

From there it opens a WebSocket to bnbnhura[.]top, a domain registered on 12 May 2026 and sitting behind Cloudflare. A ping at twenty-second intervals keeps the line open, and if the socket dies it drops back to plain HTTP.

The panel the operator works from runs on a domain he called definatelynoone[.]com. Spelling and all.

Inside it: a list of infected phones, an editor for the fake bank screens, a viewer for what came in. A macro system saves him typing the same commands twice. A session recorder plays a victim’s screen back frame by frame. A build system turns out a fresh app per affiliate, with its own name and icon.

Now the people behind it. Cleafy attributed a set of droppers using the same instal*tvtap*.apk naming convention to the Medusa banking trojan in 2024, under an affiliate botnet tagged UNKN. The tag hardcoded into RemControl is UNKK. One letter apart, the same dead-drop technique, the same countries. Group-IB calls it a possible connection and stops there, and so do I. In cybersecurity, attribution is one of the hardest problems. Tags can be copied. Code gets resold. What we know for certain is how the malware works, not who sat behind the keyboard.

Whoever built the overlays did leave traces. Russian-language notes sit inline in several of the pages, left behind during editing. The images inside those overlays hold Photoshop metadata with a creation timezone eight hours ahead of UTC, and creation dates in April 2026. That is three months before the first sample surfaced on VirusTotal on 19 July.

At the bottom of one live phishing overlay, still going out to victims, Group-IB found a complete answer from an AI assistant that someone had pasted in by mistake. Notes on what it had built, a summary of what had changed, and a closing line offering to make further adjustments.

Go up one level to the API documentation of the operator panel. It calls the phishing overlays quiz answers, the victim a person staring at the quiz, and other functions parental-monitoring. Whoever built this told a chatbot he was making a quiz app with some parental controls, got working code back, and shipped it without cleaning up after himself.

The fake pages carry two Meta Pixel tracking IDs. Someone paid to put those download links in front of people. On 16 September a court in Frankfurt ruled that Meta is liable for fraudulent third-party advertisements on its platforms, because its ranking decides who sees an ad and when. The ruling is not final. Two separate stories, one week apart, and both of them end at an advertisement someone paid for.

What to do if any of this feels close to home:

• → Look at your status bar. A key icon means a VPN connection is active. If you did not start one, something else did.
• → Settings, Accessibility, Downloaded apps. Switch off anything you do not recognise.
• → If a settings screen keeps jumping backwards before you can tap it, reboot into safe mode. Third-party apps do not run there, so the malware cannot push you out, and you can uninstall it.
• → Change your banking password from a different device, not from the infected one.
• → Call your bank on the number printed on your card, not a number that appeared on your screen.
• → Do not type a PIN into a screen that opened by itself.

The indicators, for checking a device or a proxy log:

• → Download pages: tvtap-hd[.]app | tvtap-liveapp[.]com/dl.php | vpn[.]doneplay[.]site | ff-de[.]shutgpt[.]ir | vpn[.]askarzadeh[.]com | cdn[.]dlmafi[.]top | 216[.]126[.]229[.]216
• → Command server: bnbnhura[.]top
• → Operator panel: definatelynoone[.]com | 157[.]90[.]179[.]116
• → Marker string used to unpack the configuration: numeraZZZas

From the advertisement to the PIN, this chain runs on one permission dialog. Android shows that dialog for good reasons. The rest is Android doing exactly what it was built to do.

Attacks like this one are built out of ordinary permissions, and the only way to understand them is to try them in your own lab. My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

Group-IB | ThreatFabric | Zimperium