A free app that promises live TV and sports streams is the kind of download many people grab without a second thought, and criminals know it. Researchers at Group-IB have found RemControl, a new strain of Android malware hiding inside a fake TVTap streaming app. Once it lands on a phone, it switches off one of Google’s key defences and goes straight for banking logins.
What Is RemControl and Who Is Behind It?
RemControl runs as malware-as-a-service, which means its developer rents the toolkit out to other criminals. The servers behind it have been active since at least May. By July, the first samples had surfaced with more than 30 fake banking screens aimed at users in Italy, France, Spain, Poland, Portugal, Canada, and the Middle East.
The researchers track the operator as UNKK, based on an ID shared across the samples. They also suspect a connection to Medusa, an older Android banking trojan. That link remains unproven, and so does the operator’s home country. Still, Russian text in some phishing pages points to a Russian speaker.
How the Fake TVTap App Reaches Victims
Instead of phishing emails, the operators use malicious ads that lead to fake Google Play pages for TVTap. Those fake pages carry Meta Pixel tracking codes, so the researchers believe the operator ran ads on Meta’s platforms. The bait is well chosen, since a free streaming app already feels a little unofficial.
At least one Italian campaign also used geofencing and checked each visitor’s browser. As a result, the download only appeared for mobile users in the targeted country. Everyone else saw nothing suspicious, which lets RemControl keep reaching Android phones while the malware stays out of sight.
How RemControl Malware Turns Android’s VPN Feature Against You
The moment someone opens the fake app, it quietly starts a local VPN service before it does anything else. This VPN has nothing to do with privacy. The researchers found that it blocks traffic from Google Play services, so Play Protect can no longer run the real-time checks that catch known malware.
This works because Android lets any app open a VPN tunnel after a single prompt. Plenty of people approve it without reading, since VPN apps feel familiar. ToxicPanda, a far bigger banking trojan with phishing screens for 349 financial apps, has used the same method.
That doesn’t make every VPN prompt a threat, since a trusted VPN you picked uses the same access to encrypt your traffic. In that setting, the request makes sense. A streaming app has no reason to ask for it.
What RemControl Malware Can Do on an Android Phone
After the VPN step, RemControl asks the victim to grant Accessibility permissions. Android designed these tools to help people with disabilities, but in the wrong hands they give away control of the whole screen. Once a victim agrees, RemControl has everything it needs to work as full remote-access Android malware.
Stealing Banking Credentials
The main attack uses fake login pages that sit on top of real banking apps. Victims think they are signing in as usual and hand over PINs, card expiry dates, and passwords. And because the operator can push new bank targets from its server at any time, the list of apps at risk can grow overnight.
Watching and Controlling the Phone
Like other advanced Android malware, RemControl also streams screenshots and the full screen layout to the operator in real time. It logs taps and typed text too. On top of that, the attacker can tap, swipe, and type remotely, acting inside the victim’s banking app as if holding the phone.
Pattern locks offer little protection either, since the malware captures unlock patterns on Samsung, Xiaomi, Huawei, OPPO, OnePlus, and stock Android devices. Removal is just as tricky. Whenever a victim opens the settings needed to uninstall RemControl or reset the Android phone, the malware spots it and closes them.
AI Fingerprints and a Resilient Backend
One of the phishing screens gave the game away by displaying a leftover reply from an AI assistant. The researchers see it as strong evidence that AI helped the RemControl developer build this Android malware. It’s a small slip, but it gives defenders a rare look at AI inside a working banking trojan.
The backend looks more careful, because the operator hides encrypted server addresses in Telegram channels. If defenders knock one server offline, the malware simply fetches a new address. Still, the developers left FastAPI documentation exposed on an early proxy server. That leak showed exactly how the malware pulled fake bank screens and sent stolen credentials home.
How to Protect Your Phone From Android Banking Threats
The best defence against RemControl and similar Android malware starts before anything reaches your phone. Stick to Google Play, and only install an APK when you fully trust its developer. Treat ads for free live TV or sports streams with extra suspicion, because that is exactly the bait this campaign uses.
Run Play Protect scans regularly and make sure the feature stays on. Turn down Accessibility requests from any app without a clear need for them. And if a VPN key icon appears in your status bar when you never turned on a VPN, check your installed apps right away.
Final Thoughts
RemControl squeezes a huge amount of danger into a fake streaming app, from stolen PINs to full remote control. Its most troubling trick turns a trusted Android feature against Google’s own malware scanner. A tool built for privacy ends up blinding the phone’s defences.
For now, the campaigns focus on Europe, Canada, and the Middle East. However, RemControl is a rental service, so any buyer could point this Android malware at new countries with little effort. Stick to official app stores, question odd permission prompts, and get your VPN from a provider you chose on purpose.
