🇫🇷 French, 23 October 2026, Android malware
RemControl Android malware imitates bank app, requests accessibility permission
The malware poses over 30 fake bank screens, stealing login credentials and other sensitive information.
RemControl is a banking Trojan that disguises itself as a useful app, stealing access to a user’s account. Its authors rent it out to other scammers, a model known as Malware-as-a-Service. Group-IB has observed campaigns since July 2026, on an active infrastructure since May 2026. The malware does not belong to a single scammer, but circulates between multiple networks.
The victim is tricked into downloading the malware through a fake Google Play Store page, which presents the TVTap app with an official store layout. The malware then requests accessibility permission, which is necessary for its functionality. Once granted, the malware can capture keystrokes and screen activity, and even control the device remotely.