A new Android banking malware service called RemControl is targeting mobile users through fake TVTap IPTV app download pages that imitate Google Play. Group-IB says the malware has been active since at least May 2026, with samples seen since July, and uses phishing overlays to steal banking credentials, card details, PINs, and pattern locks. It blocks Google Play Protect checks by starting a VPN service, abuses Accessibility Service permissions for remote control and data theft, and retrieves encrypted command-and-control details from Telegram channels.
Why it matters: This is a direct threat to Android users, especially people who install apps from ads or outside Google Play. Users should avoid sideloaded APK files, deny Accessibility permissions to untrusted apps, and remove suspicious TVTap-themed installs immediately.
Bill Toulas
2026.09.23
100% relevant
This article establishes a distinct new malware campaign centered on RemControl, a newly reported Android malware-as-a-service platform with its own infrastructure, distribution method, and target set.
← Back to all stories