Loading story…
Group-IB identified RemControl, an Android banking trojan distributed through counterfeit Google Play-style pages impersonating the TVTap IPTV app. The campaign selectively delivered malicious installers to Android devices using Italian IP addresses and primarily targeted users in Italy and France, while its overlays impersonated more than 30 financial institutions across Europe, the Middle East, Canada, and Gulf states. The dynamically server-hosted screens capture banking PINs, authentication codes, card-expiry details, and other credentials before restoring the legitimate banking app to limit suspicion.
RemControl abuses Android Accessibility Service permissions to read screens, log input, take screenshots, remotely control infected devices, and hinder removal. Its dropper also misuses VPN permissions to interfere with Google Play Store traffic and Play Protect scanning; newer variants use per-installation signing certificates and custom code packing to evade detection. Group-IB tracks the apparent malware-as-a-service operation as UNKK and found indications that AI assistance was used to build elements of its criminal infrastructure, but said the malware does not use AI on victims’ devices.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
The first known RemControl samples were submitted to VirusTotal, marking the earliest observed samples of the Android banking trojan.
A command-and-control domain used by RemControl was registered.
Investigators found publicly accessible operator documentation that disguised credential theft as quiz-answer handling and remote access as parental monitoring. A complete AI-assistant response left on a live phishing page suggested AI assistance was used for portions of the backend and phishing platform, though not by malware running on victims’ devices.
Group-IB linked RemControl samples to the UNKK affiliate label, which appeared in every sample, and assessed that the operation was offered as malware-as-a-service. The researchers noted possible but unproven connections between UNKK and the Medusa banking-trojan affiliate UNKN.
Researchers found that RemControl uses Android Accessibility permissions and server-hosted banking overlays to capture PINs, banking codes, card-expiry data, screen contents, and typed input, while allowing remote device interaction. Its dropper also used VPN permission to interfere with Play Store traffic and Play Protect scanning, and the malware attempted to block removal through Settings.
Group-IB identified RemControl being distributed through counterfeit Google Play-style TVTap download pages. An observed Italian campaign selectively served malicious installers to Android devices using Italian IP addresses, while the operation targeted customers of more than 30 banks across Europe, the Middle East, and Canada.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 39 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at **ThreatFabric** reported a new Android banking trojan dubbed **Massiv** that is distributed via fake *IPTV* applications and is designed to enable **device takeover (DTO)** for financial fraud. Once installed, Massiv supports credential theft and account compromise via **screen overlays**, **keylogging**, **SMS interception**, and **screen streaming** using Android’s `MediaProjection` API, allowing operators to remotely control infected devices and perform fraudulent transactions from victims’ banking sessions. ThreatFabric observed targeted campaigns that included overlays impersonating Portugal’s `gov.pt` app and its associated **Chave Móvel Digital (CMD)** digital authentication/signature ecosystem, aiming to capture phone numbers and PINs to help bypass **KYC** checks and access broader public/private services. The reporting also describes downstream abuse where stolen identity and authentication data was used to **open new bank accounts in victims’ names** for fraud and money laundering; Massiv’s remote-control capabilities include both live screen streaming and an **Accessibility Service**-based “UI-tree” mode that extracts structured UI data (e.g., element names, coordinates, and attributes) to automate interactions and potentially bypass screen-capture protections used by banking and other sensitive apps.
Jun 29, 2026
Malicious social-media advertisements impersonating a free TV streaming service distributed the **StreamRat** Android banking trojan to Spanish-speaking users in Spain. A Meta advertising campaign active from June 11 to July 3 reportedly reached about 570,000 users; this represents potential exposure rather than confirmed infections. Victims were lured through a staged sideloading process that installed a dropper, persuaded them to set it as the default launcher, and requested high-risk Accessibility permissions before downloading the primary payload. StreamRat abuses Android Accessibility Services, screen capture, and remote-touch capabilities to monitor screens, log keystrokes, capture screenshots, inventory installed apps, and take control of infected devices. It can deploy credential-stealing overlays and hide malicious actions behind black-screen or fake-update displays. The dropper may also request VPN access to temporarily disrupt other applications' internet connectivity while preserving its own connection to retrieve the payload, potentially limiting cloud-based security checks during installation.
Sep 23, 2026
Zimperium zLabs identified four Android malware families—**RecruitRat, SaferRat, Astrinox, and Massiv**—in active campaigns targeting users of more than **800 banking, cryptocurrency, and social media apps**. The malware is being spread through phishing sites, smishing messages, fake job application and streaming lures, counterfeit app-store pages, and bogus updates that trick victims into installing malicious APKs. Researchers said the campaigns rely heavily on overlay attacks, with fake login screens placed over legitimate apps to steal credentials; **RecruitRat** alone reportedly includes more than **700** fraudulent login pages. Once installed, the trojans abuse Android features including **Accessibility Services**, the **Session Installation API**, **MediaProjection**, overlays, and **WebView** to gain persistence, intercept SMS and one-time passwords, log keystrokes, enumerate apps, steal contacts, freeze screens, stream displays, and remotely control infected devices. The malware also uses anti-analysis techniques such as APK tampering, encrypted strings, reflection, dynamic DEX loading, and environment-aware execution, while command-and-control traffic is sent over HTTPS or WebSockets, with RecruitRat additionally using **RC4** encryption. Researchers warned the activity creates enterprise risk because infected employee devices can enable account takeover, bypass MFA, and expose corporate resources.
Jun 29, 2026