The malware, described as a previously undocumented banking trojan operating through a malware-as-a-service model, abuses Android’s Accessibility Service after persuading victims to grant permissions. Once enabled, it can monitor screens, capture input, inject gestures and text, and place phishing overlays over banking applications.
Group-IB said the malware has more than 30 confirmed overlay targets covering banking customers in Italy, France, Spain, Poland, Portugal, Canada and some Gulf Cooperation Council states. The target list is delivered dynamically from command-and-control infrastructure, allowing operators to change which banking applications are attacked without reinstalling the malware.
RemControl is distributed through fake Google Play pages impersonating TVTap, a third-party IPTV application that is not available through the official Play Store. Researchers identified an Italian-language campaign that used device and location checks to deliver the malicious Android package only to mobile visitors with Italian IP addresses.
The installation chain is designed to weaken Android’s protections. The initial dropper requests permission to create a local virtual private network and then blocks network traffic from the Google Play Store application, preventing Play Protect from scanning the installation live. It subsequently generates a signing certificate for each installation before deploying the RemControl payload.
After installation, the payload asks for Accessibility Service access. Group-IB said this permission enables the trojan’s control functions, enabling it to observe foreground applications, read interface elements and execute actions on behalf of the user.
When a targeted banking application is opened, RemControl can display a full-screen WebView that covers the genuine interface. These overlays can request PINs, mobile banking codes, card expiry dates and other information. Once data is submitted, the fake screen can close and return the victim to the legitimate banking app, reducing the chance that the fraud is noticed.
The malware can also stream screenshots of the device in real time while transmitting the full accessibility interface tree, which describes visible buttons, text fields, coordinates and other interactive elements. This combination gives an operator both a visual feed and a structured map of the screen, allowing direct remote interaction.
Its input-monitoring functions extend beyond banking apps. RemControl can log clicks, text changes, focus changes and selection events across applications. Operators can remotely perform taps, long presses, scrolling, swipes, gesture strokes and text injection, according to the technical analysis.
Researchers also found code designed to capture Android pattern-lock information across several device implementations, including Samsung One UI, Xiaomi MIUI, Huawei, OPPO ColorOS, OnePlus and stock Android. By collecting the coordinates of the lock-pattern grid, the malware can help an operator reconstruct a victim’s unlock pattern.
Removal is made harder through self-protection features. RemControl watches for attempts to open application-management, accessibility and factory-reset settings. When such screens are detected, it can automatically trigger a back action to close them. The mechanism includes interface strings in more than 30 languages, allowing it to operate across different regional configurations.
The malware’s command-and-control address is not permanently embedded in the application. Instead, RemControl retrieves encrypted information from Telegram pages and decrypts it to identify the active server. Group-IB said this arrangement allows operators to rotate infrastructure without rebuilding the malware.
The company said its investigation also exposed documentation for the operator panel, revealing affiliate tracking, malware-building functions, overlay management and remote-control commands consistent with a commercial malware-as-a-service operation. Samples first observed in July were linked to infrastructure active since May.
Researchers found indications that artificial intelligence tools were used during development, including a complete AI-assistant response left inside a live phishing page. Group-IB also identified Russian-language comments in several overlay files, while cautioning that such technical artefacts alone do not establish the identity or location of the developer.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
