RemControl: AI Built the Overlays. Victims Lose their PINs

RemControl is an Android banking trojan operating as Malware-as-a-Service since May 2026. It targets over 30 financial institutions in Western Europe, the Middle East, and Canada via fake TVTap IPTV download pages distributed through malvertising. The malware abuses Android Accessibility Service to inject phishing overlays, stream device screens in real-time, log keystrokes, and enable full remote control. The criminal infrastructure was partially built using AI-generated content, including phishing pages and C2 panel documentation. The threat actor UNKK operates these campaigns, with possible links to the Medusa UNKN affiliate botnet.

• Inside "MR ROBOT" - Anatomy of a Malware-as-a-Service Operation Targeting Indian Bank CustomersMalware2026-10-28
• New RemControl Android Banking Trojan Steals PINs Using AI-Built Phishing OverlaysMalware2026-09-24
• Hirudo: From Fake Updates to Patched Banking AppsMalware2026-10-14
• From BlackCat to Panda Workshop: Inside the Evolving C2 Panel Behind RATHatMalware2026-09-28
• Vwork: Weaponized Open-source Software as an Addon for GigabudMalware2026-09-09