A newly identified Android banking trojan, dubbed RemControl, is employing AI-generated overlay attacks to swipe banking PINs and other sensitive credentials. The deceptive campaign targets users through fake streaming app downloads hosted on phishing pages impersonating Google Play storefronts; victims only encounter the malicious installer when visiting from certain geographic regions like Italy. Researchers first noticed RemControl in July 2026. Its impact spans over 30 banking institutions across Europe, the Middle East, and Canada. Unconfirmed reports suggest France and Italy are heavily hit.
How RemControl Pulls the Switch on Users
Once the malware is inside the Android device, it monitors for launches of banking apps. When one opens, RemControl projects a full-screen fake bank interface. Users may then input their banking PIN, card details, or one-time codes—all into the counterfeit overlay. Once the credentials are collected, the overlay vanishes, and the authentic banking app reappears, keeping the victim unaware of any breach.
The overlay is not embedded directly in the app. Instead it is fetched from a remote server controlled by attackers—enabling the threat actors to dynamically adjust targets without updating the malicious APK. Scripts and UI elements are delivered in real time, making detection and blocking harder. The setup bears similarity to other trojans that load fake screens over trusted apps.
Installation, Remote Controls, and Evasion Tactics
Installation begins when the user falls for a fake streaming-app update prompt. The installer requests permissions typically reserved for VPN usage, and actively cuts off network traffic between the device and the real Play Store at the time of installation—preventing Google’s security checks from flagging the APK in transit.
Each malicious build is signed with a freshly generated certificate so signature-based detection becomes very difficult. After installation, RemControl requests Android’s Accessibility access. This grants it rights to read screens, capture input events, take screenshots, and simulate user interactions—such as taps or swipes—on behalf of a remote operator.
The malware can also monitor on-screen content, reconstruct unlock patterns, block users from accessing system settings when removal is attempted, and log keyboard input. All of this is mediated via a control panel, where an operator manages infected devices and harvested data. Samples suggest ties to an affiliate network dubbed UNKK, though links to larger banking malware operations remain under investigation.
AI Role, Targets, and Indicators
AI shows up not as part of the malware running locally, but as an assistant helping build phishing overlays and guiding operations. The research team found proof of those tools—chat logs using quiz-answer analogies and instructions hidden in overlay code, for example. These findings point to a campaign using AI to craft more credible fake screens.
Data from the report includes infected institutions across Europe, the Middle East, and Canada, with Italy and France being prominent examples. The operations are flexible: operators use Telegram channels to host configuration files, which can redefine the server addresses used by infected apps without pushing new versions.
Among signs of compromise are URLs mimicking TV streaming app download sites, domains used as proxy servers or operator panels, and APK filenames including “tvtap.” A number of SHA-256 hashes tied to droppers and payloads, plus configuration markers decoded from strings like “numeraZZZas,” provide further detection points for defenders.
How to Stay Safe
Users should steer clear of downloading apps outside of official stores, especially via links or sites not endorsed by trusted sources, even if the page mimics a familiar store. Be wary of apps requesting VPN or Accessibility permissions without a clear reason, especially post-install. If an app unexpectedly prompts for a banking PIN or card info—particularly outside a transaction flow—double check whether you’re in the authentic banking app.
If there’s any suspicion of account compromise, reach out to your bank through official channels rather than via links or phone numbers given on suspicious pages.
Indicators of Compromise: A sample of suspicious URLs includes variations tied to “tvtap” and fake VPN sites, plus domains used for control. Droppers’ SHA-256 hashes and subtle markers in config strings also form part of the detection infrastructure available to defenders.
What this means: RemControl represents a sharp escalation in banking malware sophistication. The combination of server-side overlays, AI-crafted phishing content, and dynamic payload delivery poses serious challenges for both users and security tools. As attackers weaponize AI to refine social engineering and camouflage, defenders will need better behavioral detection, stricter permission governance, and broader user education. Watching how RemControl evolves—and whether similar malware starts blending machine-generated content with remote control—is essential.
