New RemControl Android Banking Trojan Steals PINs Using AI-Built Phishing Overlays

RemControl is an Android banking trojan first observed in July 2026 that targets financial institutions across Western Europe, the Middle East, and Canada. The malware is distributed through fake Google Play Store pages advertising TVTap, an IPTV application, using malvertising campaigns with geo-targeted delivery. Once installed, the dropper creates a local VPN to block Play Protect checks and generates unique signing certificates per installation. RemControl exploits Android Accessibility Service permissions to display phishing overlays for over 30 banking applications, capturing PINs, mobile banking codes, and card details. The malware includes remote control capabilities, screen streaming, keylogging, and lock-screen pattern capture. It operates as Malware-as-a-Service with infrastructure showing evidence of AI-assisted development in phishing page creation and documentation.

• RemControl: AI Built the Overlays. Victims Lose their PINsMalware2026-09-23
• Upgrades MaaS Ecosystem with Modular ToolsMalware2026-07-23
• Android Banker with Complete Device Takeover CapabilitiesMalware2026-06-16
• From Streaming to Stealing: Mirax and the Rise of Server-side Android Device Takeover in METAMalware2026-11-05
• False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking AppsMalware2026-10-28