Researchers at Group-IB have detailed a new Android banking trojan, tracked as RemControl, that spreads through counterfeit Google Play Store listings impersonating the TVTap IPTV app and through malvertising campaigns, with confirmed targeting in Italy, France, Spain, Poland, Portugal, Canada, and Gulf Cooperation Council states. Once installed, RemControl requests Accessibility Service permissions, then uses that access to overlay fake login screens on top of legitimate banking apps to steal PINs and capture pattern-lock data across multiple device makers. The malware also streams the device screen and logs keystrokes in real time, blocks Google Play Protect through a local VPN service during installation, and generates a unique signing certificate for every install to defeat hash-based detection. To resist removal, it monitors which app is in the foreground and automatically redirects users away from the system settings screen if they try to uninstall it. Group-IB attributes the operation to a threat actor it tracks as UNKK, identified through hardcoded affiliate tags in the malware’s command infrastructure.
For mobile security and fraud teams, RemControl shows Accessibility Service abuse remains the dominant technique for Android banking trojans, the same disguise-driven trust abuse behind the fake-job malware kits security agencies warned about this year. Detection built on static app scanning or Play Store vetting alone will keep missing families like this one, since the malicious behavior only activates after the accessibility grant, and the certificate rotates per install to defeat signature matching, much like other recent malware built to slip past signature-based defenses.
The original insight is in the disguise choice. Posing as parental-monitoring or device-management software, rather than a generic utility, gives RemControl a built-in justification for the Accessibility Service permission it needs, since parental-control apps legitimately request the same access. That framing likely raises the share of users who grant the permission without hesitation, which makes app-category-aware permission review, not just permission-count review, a more useful control for mobile threat defense teams to add.
Source: Group-IB
