Malware
RemControl Android Banking Malware Targets European and Canadian Users via Fake IPTV Ads
RemControl, a new Android malware‑as‑a‑service platform, has been delivering banking trojans through fake TVTap IPTV ad sites. The campaign, active since May, targets users in Italy, France, Spain, Poland, Portugal, Canada and the Middle East. Defenders should block known malicious domains, enforce app‑store vetting, and monitor for phishing overlays on Android devices.
What Happened
RemControl is a new Android malware‑as‑a‑service (MaaS) that injects banking trojans through malicious ad sites that masquerade as the TVTap IPTV application.
Targeted Regions
The operator has focused on users in Italy, France, Spain, Poland, Portugal, Canada and several Middle‑Eastern countries.
Distribution & Tactics
- Fake Google Play pages that use geofencing and mobile User‑Agent checks.
- At least 30 phishing overlays that steal banking credentials and display an AI‑powered assistant UI.
- Embedded Meta Pixel tracking IDs, indicating use of Meta’s advertising ecosystem to drive traffic.
- The dropper launches a VPN service that blocks legitimate Google Play traffic.
Mitigation Steps
- Block all known RemControl domains and IP ranges in network firewalls and DNS filtering solutions.
- Enforce strict app‑store vetting and monitor for unauthorized APK downloads.
- Deploy mobile threat‑defense platforms that detect phishing overlays and VPN hijacking.
- Educate users about the risks of installing apps from unofficial sources and verify the publisher’s identity.
Related articles
Hirudo Android Trojan Replaces Banking Apps with Patched Versions to Evade Security Checks
A new Android banking trojan, Hirudo, replaces legitimate banking apps with custom patched copies that bypass in‑app integrity and signature checks. The malware, delivered via popular dropper apps, steals credentials, takes device control, and captures screens, cameras, and SMS. Defenders should audit banking app integrity, block suspicious in‑app updates, and monitor for unauthorized accessibility services.
Read briefing
Hirudo Android Malware Hijacks Banking Apps to Steal Credentials
Hirudo is an Android malware that replaces legitimate banking apps with malicious copies, disabling security checks to harvest credentials and remotely control devices. It targets banks in Indonesia, China, India, Mexico, Morocco, and Thailand, and is delivered via apps that masquerade as shopping or entertainment services. Defenders should verify app signatures, enforce Play Integrity, restrict Accessibility permissions, and deploy mobile security solutions to detect hooking engines.
Read briefing
Ajina.Banker Android Malware Targets Central Asia: Steals Banking Credentials and 2FA Messages
In May 2024, Group‑IB uncovered Ajina.Banker, an Android banking trojan that masquerades as legitimate apps to harvest credentials and intercept 2‑factor SMS. The malware has been active across Central Asia, compromising users of popular banking apps. Defenders should verify app provenance, enforce app whitelisting, and monitor for anomalous SMS traffic.
Read briefing
BTMOB Android RAT: Phishing, Fake App Stores, and Accessibility Exploit
BTMOB is an Android RAT that spreads via phishing sites and counterfeit app stores, then abuses Accessibility Services to gain full device control. The malware is sold with an APK‑builder, enabling rapid, code‑free payloads. Defenders should block malicious domains, disable unknown accessibility services, and enforce app‑store vetting.
Read briefing