RemControl: Android Banking Trojan Uses AI to Clone Home Banking Apps

Group-IB has discovered RemControl, a malware-as-a-service platform for Android distributed via malvertising that impersonates the TVTap IPTV app. The first samples emerged in July 2026, with infrastructure active since May. The trojan combines a sophisticated mechanism for evading Google Play Protect with AI-assisted phishing overlays, targeting banking users in Italy, France, Spain, Poland, Portugal, Canada, and GCC states.

How the Multi-Stage Dropper Works

The infection mechanism unfolds in multiple stages designed to maximize persistence and stealth. Users are tricked into installing an APK disguised as TVTap IPTV through ads on Meta: six distribution URLs identified from the Italian campaign serve the payload exclusively to mobile devices with Italian IPs, with pages localized in Italian.

Once installed, the dropper requests activation of a local VPN service. According to Group-IB's analysis, the code exploits BIND_VPN_SERVICE to route com.android.vending traffic into a null VPN tunnel, isolating the Google Play Protect component from the network. This prevents the system from running real-time scans on the malicious package. Simultaneously, the dropper generates a new signing key in the Android Keystore for each installation: the subject remains constant (CN=Android Debug, O=Android, C=US), but the fingerprint changes, rendering hash-based detections ineffective.

The main payload then requests Accessibility Service permissions. With this access, RemControl gains full device control: it can execute taps, swipes, scrolling, gestures, long presses, and remote text injection. It logs clicks, text changes, focus events, and other user input across applications, transmitting screenshots and the full accessibility/UI tree to the operator in real time.

AI Overlays and Banking Credential Theft

RemControl's distinctive capability lies in its full-screen phishing overlays, retrieved dynamically from the C2 server and not stored locally on the device. Group-IB identified over 30 overlays targeting retail banking applications across the seven confirmed countries.

These overlays clone the interface of legitimate banking apps to steal PINs, banking codes, card expiration dates, and credentials. The malware also captures pattern lock coordinates on devices from at least seven OEMs: Samsung, Xiaomi, Huawei, OPPO, OnePlus, and stock Android. To prevent removal, it detects when the victim accesses application management, accessibility, or factory reset settings, automatically exiting the interface to avoid uninstallation.

"What sets this investigation apart is what was found when examining the operator's infrastructure. The C2 panel's API documentation was inadvertently exposed during analysis, revealing a build system and affiliate tracking infrastructure indicative of a Malware-as-a-Service platform, with clear artifacts of AI-assisted development throughout, including a complete AI assistant response found verbatim in a production phishing page actively served to banking victims." — Group-IB researchers

The Unintentional AI Fingerprint

The most significant element from a detection standpoint is the trace left by generative AI in production material. The complete AI assistant response was found not in internal documentation or a staging environment, but in a phishing page actively served to banking victims. This creates a new category of unintentional compromise indicators: linguistic and structural artifacts generated by language models that, precisely because of their automated origin, can become detectable signatures.

Russian-language comments identified in multiple overlay HTML files indicate a Russian-speaking developer for at least part of the material. However, the precise origin of the threat actor remains uncertain. The link to the Medusa trojan is suspected but unconfirmed: overlaps in campaign naming conventions, similar delivery mechanisms, shared use of Telegram dead-drops, and similarities in affiliate tags constitute circumstantial evidence, not proof of operational continuity.

Mitigation and Next Steps

For Android users in targeted countries, primary mitigation relies on behavioral controls: verify the source of every APK before installation, even when promoted through ads on mainstream platforms; systematically refuse VPN service activation requested by entertainment apps; and deny Accessibility Service permissions to any application not explicitly designed for accessibility.

For financial institutions and security teams, the evidence of AI-generated overlays demands updating detection systems to identify linguistic and structural patterns typical of generative models, alongside monitoring for the VPN-based Play Protect bypass mechanism. C2 resolution via Telegram dead-drop also requires traffic analysis capabilities toward the messaging platform's servers, often underestimated in mobile defense architectures.

The dropper supports over 30 languages, suggesting potential geographic expansion that makes current geofencing a limited indicator of future reach. The primary domains tvtap-hd.app and tvtap-liveapp.com, registered on July 10, 2026, remain useful references for filtering, but dynamic C2 infrastructure rotation reduces their effectiveness over time.

The discovery of RemControl signals a transformation in mobile banking malware: generative AI is no longer just a tool for defense or propaganda, but a productive component of attack infrastructure, with technical footprints potentially exploitable by defenders. The same AI response that accelerated crime development could become its most detectable vulnerability.

Information verified against cited sources and current as of publication.

Sources

• https://www.bleepingcomputer.com/news/security/new-remcontrol-android-banking-malware-targets-users-in-europe-and-canada/
• https://radar.offseq.com/threat/new-remcontrol-android-banking-malware-targets-users-in-europe-and-canada-bd1003f927bb3dd6
• https://github.com/SecOpsNews/news/issues/74345
• https://www.group-ib.com/blog/remcontrol-android-banking-trojan/
• https://support.github.com/
• https://github.com/SecOpsNews/news/issues
• https://github.com/SecOpsNews/news/pulls
• https://github.com/SecOpsNews/news/security
• https://www.bleepingcomputer.com/