RemControl enables remote takeover of Android banking devices

A newly discovered Android banking trojan called RemControl is giving cybercriminals remote control over compromised phones while pilfering banking credentials via overlays, according to research from cybersecurity firm Group-IB. This malware, operating via a malware-as-a-service model, exploits Android's Accessibility Service after duping victims into granting necessary permissions.

Once activated, it can monitor screens, capture user input, inject gestures and text, and overlay phishing content onto banking applications. Group-IB reports that RemControl has compromised over 30 banking targets in countries including Italy, France, Spain, Poland, Portugal, Canada, and several Gulf Cooperation Council states.

The list of targeted banks is dynamically fetched from command-and-control servers, enabling operators to alter their attack focus without re-installing the malware. Distributed through fake Google Play pages masquerading as TVTap, a third-party IPTV application not found in the official Play Store, RemControl targets Italian-speaking users by checking device and location data.

The installation process is engineered to undermine Android's defenses, starting with a request for VPN creation permissions, blocking network traffic from the Google Play Store app, and thereby evading Google Play Protect scans. Subsequently, the malware generates a unique signing certificate for each installation and deploys the RemControl payload.

Post-installation, the payload prompts the user for Accessibility Service permissions, granting the trojan control over the device. Once a targeted banking app is launched, RemControl can display a full-screen WebView, obscuring the genuine interface and requesting sensitive information such as PINs, mobile banking codes, card expiry dates, and more.

Once the victim submits this data, the fake screen can close, returning the user to the legitimate app and minimizing suspicion. The malware can also capture real-time screenshots of the device while simultaneously transmitting the full accessibility interface tree, providing both visual and structural insights to operators. While RemControl's primary focus is on banking applications, it can also monitor user interactions across all applications, logging clicks, text changes, focus changes, and selection events.

Operators can remotely perform various actions, including taps, long presses, scrolling, swipes, gesture strokes, and text injection. RemControl's self-protection features further complicate removal processes, as it watches for attempts to open application-management, accessibility, and factory-reset settings, automatically closing these screens to prevent interference.

The malware identifies the command-and-control server dynamically by retrieving encrypted data from Telegram pages, allowing operators to change infrastructure without modifying the malware. Group-IB's investigation uncovered additional evidence of a commercial malware-as-a-service operation, including operator panels with affiliate tracking, malware-building functions, overlay management, and remote-control commands.

Evidence of artificial intelligence usage during development was also found, including a live AI response embedded in a phishing page. Though the malware's command-and-control address is not permanently embedded, it is dynamically fetched from Telegram, allowing for seamless infrastructure rotation. Russian-language comments were discovered in several overlay files, though Group-IB cautioned that such technical artifacts do not definitively pinpoint the developer's identity or location.