Cybersecurity
RemControl malware targets banking users in Europe and Canada
Group-IB said a new Android malware platform called RemControl used fake TVTap pages, targeted several regions and stole banking data through phishing overlays and remote-control features.
- Group-IB said RemControl was a new Android malware-as-a-service platform delivered through malvertising that impersonated the TVTap IPTV app.
- The company said the infrastructure had been active since at least May, and the first samples appeared in July with more than 30 phishing overlays.
- Group-IB said the malware targeted users in Italy, France, Spain, Poland, Portugal, Canada and the Middle East.
- It said the dropper blocked Google Play services to stop Play Protect checks, and that a similar technique had been seen in ToxicPanda.
- The researchers tracked the operator as UNKK, said some overlay HTML contained Russian language, and suspected a link to Medusa.
Group-IB said RemControl was a new Android malware-as-a-service platform spread through fake pages for the TVTap IPTV app. It said the infrastructure had been active since at least May, while the first samples appeared in July and carried more than 30 phishing overlays to steal banking credentials.
The researchers said the malware targeted users in Italy, France, Spain, Poland, Portugal, Canada and the Middle East. They said one Italian campaign used geofencing and mobile User-Agent checks, and that the malicious sites carried Meta Pixel tracking IDs.
When installed, the dropper started a VPN service that blocked traffic from Google Play services and prevented Play Protect checks. Group-IB said a similar mechanism had also been seen in ToxicPanda.
If users granted Accessibility Service permission, RemControl could display phishing overlays, gather PINs, banking codes and credentials, stream screenshots and accessibility data, and control the device remotely. Group-IB also said it retrieved encrypted C2 data from Telegram channels, found exposed FastAPI documentation in the initial proxy, and tracked the operator as UNKK while suspecting a link to Medusa.
The researchers said the origin of the actor was unclear. They said Russian-language text in some HTML files suggested a Russian-speaking developer for at least some overlays, and advised users to avoid APKs from outside Google Play and to decline unnecessary Accessibility requests.
Named in this story
Companies
- Group-IB
- cybersecurity company whose researchers analysed the malware
- Meta
- company whose advertising ecosystem was suspected of being abused
Products and systems
- RemControl
- Android malware-as-a-service platform spread through fake download pages
- TVTap IPTV application
- the app impersonated by the malicious pages
- Meta Pixel
- tracking IDs on the malicious sites
- Google Play
- store whose pages were spoofed
- Google Play services
- service whose traffic the dropper blocked
- Play Protect
- Google check that the malware tried to stop from running
- ToxicPanda
- malware family with a similar blocking technique
- Telegram
- messaging platform whose channels supplied encrypted C2 data
- FastAPI
- software whose documentation exposed C2 endpoints
- Medusa
- banking trojan the researchers suspected was connected
Places
- Europe
- region where users were targeted
- Italy
- country involved in a geofenced campaign
- France
- country where users were targeted
- Spain
- country where users were targeted
- Poland
- country where users were targeted
- Portugal
- country where users were targeted
- Canada
- country where users were targeted
- Middle East
- region where users were targeted
How the source tells it
The piece used a restrained technical register, but it also made a few speculative inferences about AI use and infrastructure abuse.
- novelty presents the malware as new and emphasises first sightings and added features
- speculation presented as fact treats conclusions about AI involvement and ad-ecosystem abuse as strong indicators and hints