RemControl: Android Banking Trojan Uses AI-Assisted Overlays and a Local VPN

RemControl is an Android banking trojan that utilizes AI-generated overlays and a local VPN to steal user credentials and gain remote control of infected devices. Discovered in September 2026, this malware targets over 30 financial and cryptocurrency services, with campaigns primarily aimed at users in Europe, the Middle East, and Canada.

The malware's dropper employs a fake Google Play page to distribute the APK, which prompts the user to install a VPN to bypass Play Protect checks. Once installed, the malware requests Accessibility Service permissions, allowing it to monitor the screen, perform remote gestures, and input text. The trojan then retrieves the command and control (C2) connection destination from encrypted data on Telegram and communicates using WebSocket as the primary channel and HTTP as a backup.

When a target app matches the victim's foreground app, RemControl displays a fake banking screen to collect input data. High visibility is limited to victims, while administrators and SOCs may detect the malware through low visibility signs such as APKs signed with unrecognized certificates, granted Accessibility permissions, and persistent WebSocket traffic.

To mitigate RemControl, organizations should block app installations from unknown sources, limit Accessibility permissions, block unauthorized apps and APKs signed with unrecognized certificates via mobile device management (MDM), and investigate unauthorized WebSocket connections.