RemControl Android Trojan Uses Accessibility Services to Steal Banking Credentials

Group-IB researchers have discovered a new Android banking trojan named RemControl that has been targeting retail banking customers across Canada, the Middle East, and Western Europe since July 2026.

The malware has been observed targeting more than 30 banking institutions across six countries. It leverages the Android Accessibility Service to gain full remote control over victim devices and extract sensitive financial credentials.

AI-Assisted Infrastructure and Evasion

The malware developer, a Russian-speaking operator tracked as UNKK, appears to have used an AI assistant to build significant portions of the command and control (C2) backend and phishing overlays. Researchers believe the developer may have tricked the AI model into generating the code by presenting the API endpoints as components for a parental monitoring application.

RemControl is typically distributed through fraudulent Google Play Store pages that impersonate the TVTap IPTV application. These pages are personalised using IP geolocation and user-agent data to match the visitor’s local language.

To evade detection, the trojan employs several sophisticated techniques. It launches a local VPN service to route traffic from Google Play Protect through a null channel, effectively suppressing the built-in Android security tool. Additionally, the dropper generates a new signing key in the Android Keystore to sign the RemControl payload, which helps it bypass hash-based detection.

Device Control and Data Theft

Once the Accessibility Service permission is granted, RemControl can capture the device screen, provide a machine-readable map of the user interface, and perform keylogging. This allows the attacker to track user activity, including clicks, selection changes, and unlock patterns.

The trojan also uses full-screen WebView overlays to impersonate legitimate banking applications. These overlays are designed to collect PIN codes, mobile banking codes, and card expiry dates. To maintain access, the malware includes self-preservation functions that can prevent application removal and block factory reset screens.

Stolen data is exfiltrated through a Telegram dead-drop mechanism and a WebSocket channel using JSON envelopes.

Mitigation Strategies

To reduce the risk of infection, security researchers recommend the following actions:

• Avoid clicking on suspicious links received via email, SMS, or social media.
• Install applications only from official platforms such as the Google Play Store.
• Be wary of any application that requests excessive or unexpected permissions, particularly Accessibility Services.
• Never enter banking PINs, mobile banking codes, or card details into an unexpected or suspicious screen.