RemControl is an Android malware-as-a-service platform active since at least May 2026, distributed through fake Google Play pages mimicking the TVTap IPTV app. It uses geofencing and mobile User-Agent checks to target specific regions. Upon installation, it requests Accessibility Service permissions and starts a VPN service to block Google Play Protect. With granted permissions, it can display full-screen phishing overlays on banking apps, steal credentials including PINs and card details, stream screenshots and UI data, record user inputs, perform remote gestures, capture pattern-lock coordinates on multiple OEM devices, and prevent removal by detecting user attempts to uninstall or reset. The malware fetches encrypted command-and-control data from Telegram channels, allowing dynamic infrastructure rotation. Researchers associate the operator UNKK with Russian language artifacts and a possible link to the Medusa trojan.

The malware can steal sensitive banking credentials, including PINs, card expiry dates, and login information, by overlaying phishing screens on legitimate banking apps. It can monitor and record user interactions in real time, remotely control the device's UI, and capture pattern-locks on major Android OEM devices. It also prevents removal attempts, increasing persistence. This poses a significant risk of financial theft and unauthorized access to banking and financial accounts for affected users in targeted regions.

Users should avoid downloading APK files from outside the official Google Play Store unless the publisher is explicitly trusted. Decline Accessibility Service permission requests from apps that do not require them for legitimate accessibility purposes. Regularly use Google Play Protect scans to detect known malware. There is no indication that a patch or fix exists for this malware; mitigation relies on user caution and permission management.