A newly discovered Android banking trojan abuses Accessibility Services to seize remote control of victims' devices and steal credentials including PIN codes, mobile banking codes and card expiry dates, according to a Group-IB report published September 23, 2026. The malware, which its operator calls RemControl, has been observed attacking retail banking customers throughout Western Europe, the Middle East and Canada since July 2026. With confirmed attacks on more than 30 banking institutions across six countries, the threat is significant for both financial institutions and their customers.
Victims are tricked into downloading RemControl through counterfeit Google Play Store pages that impersonate the TVTap IPTV application, with pages customized to local languages based on the visitor's user-agent and IP geolocation. After the download, users see a WebView-based interface masquerading as a TVTap update screen, and clicking "install" triggers a dropper that performs multiple actions to evade detection and install the malware. The dropper launches a local VPN service routing traffic from Google Play Protect through a null VPN channel, and it creates a fresh signing key in the Android Keystore to sign the RemControl payload before installation to dodge hash-based detection. Once installed, the payload immediately seeks Accessibility Service permissions from the victim, which if granted, hands RemControl complete control over the device. The malware supports multiple languages, suggesting RemControl may broaden its operations to additional regions in the future.
The Group-IB researchers noted that "VPN-based Play Protect suppression is becoming a recurring pattern in Android dropper development, reflecting a broader awareness of mobile security mechanisms among Android malware developers." At the stage when RemControl gains accessibility permissions, the trojan can execute a range of functions engineered to capture sensitive banking information from the victim, including inflating a full-screen WebView overlay that collects credentials such as PIN codes, mobile banking codes and card expiry dates depending on which institution is targeted. The overlay completely covers the legitimate banking application from the victim's perspective. According to the report, RemControl can also exploit the accessibility service to capture the device screen, providing the operator a machine-readable map of every visible UI element including coordinates, text content and interactive state. The trojan captures keylogging and pattern lock data, letting the attacker monitor user activity such as clicks, selection changes and unlock patterns, and it has a self-preservation function to maintain persistent access by preventing application removal and factory reset screens.
The malware developer, believed to be a Russian-speaking operator tracked as UNKK, appears to have used an AI assistant to build substantial portions of the command and control backend and phishing overlays. The developer likely deceived the AI model into believing the API endpoints it created were for a parental monitoring app, resulting in what the report describes as "a functional banking fraud platform whose own documentation describes credential theft as quiz completion and banking victims as 'a person staring at the quiz.'" RemControl's C2 panel's API documentation was accidentally exposed during the Group-IB analysis, allowing researchers to gain deep insights into the trojan's infrastructure. Captured data is transmitted through a Telegram dead-drop mechanism, concealing the real C2 address behind an additional layer, with the primary channel being a WebSocket using messages with a JSON envelope containing fields cmd, udid, rid and data.
Group-IB set out recommendations for banking customers using Android devices to avoid falling victim to RemControl, including not clicking on suspicious links received via email, SMS or social media, installing applications only from official platforms such as Google Play Store, being suspicious of apps requesting excessive or unexpected permissions including Accessibility Service permissions, and never entering banking PIN, mobile banking code or card details into a screen that appeared unexpectedly. The malware's multi-language support and sophisticated evasion techniques suggest operators are positioning for expanded geographic reach and sustained campaigns against financial institutions. The accidental exposure of RemControl's infrastructure offers banks and security teams a rare opportunity to understand and defend against this emerging threat before it scales further, though the developer's resourcefulness in manipulating AI tools to build fraud infrastructure signals a troubling evolution in how quickly sophisticated malware can now be constructed.