GROUP-IB researchers have identified a new Android banking trojan, RemControl, operated by a group they track as UNKK. The malware is being distributed through malicious adverts on Meta platforms that lead users to fake Google Play pages offering a free TVTap IPTV application. The campaign uses geofencing and mobile User-Agent checks to show the malicious app only to selected targets; one campaign specifically focused on Italian IP addresses.
Researchers say RemControl has targeted customers of more than 30 banking institutions across Italy, France, Spain, Poland, Portugal, Canada and the Middle East, although the total number of victims is unconfirmed.
Once installed, the dropper requests permission to install additional applications and abuses Android Accessibility Services to control the device. It can place fraudulent overlays over legitimate banking apps to capture PINs, card expiry dates and login credentials, stream the screen to the operator, and record Android pattern-lock coordinates across multiple manufacturers. Its command-and-control communications use encrypted Telegram dead-drops.
The malware also attempts to maintain persistence by closing application-management and factory-reset menus, while a VPN service blocks traffic to Google Play services and prevents Play Protect from carrying out real-time checks.
Group-IB found Russian-language artefacts in some overlay HTML and suspects a possible link to the older Medusa banking trojan, but the operator’s identity remains unknown and no charges have been announced. The researchers describe the operation as Malware-as-a-Service. They recommend avoiding applications downloaded outside the official Google Play Store; mobile-device-management tools can help organisations block unauthorised installations.