RemControl is a sophisticated Android banking trojan that emerged in mid-2026, targeting users primarily in Western Europe, the Middle East, and Canada. It is distributed through deceptive fake Google Play Store pages promoting the TVTap IPTV application, leveraging geo-targeted malvertising campaigns. Upon installation, the malware deploys a local VPN to circumvent Google Play Protect security checks and generates unique signing certificates for each infection instance. It exploits Android Accessibility Service permissions to overlay phishing screens on more than 30 banking applications, enabling the theft of sensitive information such as PINs, mobile banking codes, and card details. The trojan also includes advanced features like remote control of the device, screen streaming, keylogging, and capturing lock-screen patterns. The infrastructure behind RemControl indicates it is offered as Malware-as-a-Service with evidence of AI-assisted development to enhance phishing overlay creation and documentation.

The trojan can steal sensitive banking credentials including PINs, mobile banking codes, and card details by displaying phishing overlays on legitimate banking apps. It can also monitor user activity through keylogging, screen streaming, and lock-screen pattern capture, potentially leading to unauthorized access to financial accounts and identity theft. The use of local VPN to block security checks increases persistence and evasion capabilities.

No official patch or remediation guidance is provided. Users should avoid installing applications from unofficial or suspicious sources such as fake Google Play Store pages. Monitoring for unusual VPN usage and restricting Accessibility Service permissions to trusted applications can help reduce risk. Since this is malware, standard mobile security best practices and endpoint protection solutions may help detect and remove infections.