RemControl: Android Banking Trojan Uses AI-Assisted Overlays and a Local VPN

1. Basic Information

• Original Title: RemControl: AI Built the Overlays. Victims Lose their PINs
• Published Date: 2026-09-23
• Updated Date: None
• Collection Date: 2026-09-24T08:09:37+09:00
• Source: Group-IB
• Severity: high
• Type: Threat Intelligence
• Target Period: 2026-09-23T08:14:06+09:00 to 2026-09-24T08:09:37+09:00 (Asia/Tokyo)
• Original Link: RemControl: AI Built the Overlays. Victims Lose their PINs
• Related Sources: BleepingComputer: New RemControl Android banking malware targets users in Europe and Canada
• Severity Rationale: It is a MaaS targeting over 30 financial and cryptocurrency services, with Observed campaigns target financial institutions in Europe, the Middle East, and Canada, with Italy and France identified as the main targets. It blocks Play Protect traffic on the device and features remote control, PIN theft, and uninstall prevention.
• Reason for Update: Corrected the order of VPN, payload deployment, and Accessibility permission, the confidence level of malvertising, and the basis for AI assistance. Attribution evaluations were moved to sourced Facts and mapped to ATT&CK Mobile.

2. Executive Summary

RemControl uses phishing overlays and Android Accessibility services to steal banking credentials and gain remote control of devices. Its dropper uses a local VPN to disrupt Play Protect checks.

3. Attack Flow

Fake TV App Installation and Privilege Acquisition

1. A fake Google Play page mimicking TVTap filters visitors by IP geolocation and User-Agent to distribute the APK. Based on the presence of Meta Pixel, Group-IB infers the use of malvertising.
2. When the user installs the dropper, a fake update screen prompts them to use a local VPN. The VPN blocks traffic from the Google Play Store app, preventing Play Protect checks during installation.
3. The dropper generates a signing key for each installation, signs the RemControl payload, and deploys and launches it via PackageInstaller.
4. The payload asks the user for Accessibility Service permission. Once granted, it can use features like screen monitoring and remote control.

Post-Installation Communication, Theft, and Remote Control Features

1. It retrieves the C2 connection destination from encrypted data on Telegram, communicating via WebSocket as the primary channel and HTTP as a backup.
2. When the foreground app matches a target list received from the C2, it displays a fake banking screen to collect input data.
3. Features include screen and UI tree monitoring, remote gestures, text input, keylogging, lock info retrieval, and prevention of settings screens or uninstallation. This does not mean all features are executed for every victim.

4. Attacker Location and Execution Environment

• Operators of malvertising or fake distribution sites
• Remote operators communicating with Android devices via WebSocket/HTTP C2
• Parties capable of updating dead drop information on Telegram

5. Visibility for Victims and Administrators

Victims

• Screens prompting the installation of a TV streaming app and Accessibility permissions
• Realistic login screens overlaying banking apps
• Behavior where the settings screen cannot be opened or the app cannot be uninstalled

Administrators and SOCs

• Low visibility on unmanaged devices
• In MDM/EDR environments, clues include APKs signed with unrecognized certificates, granted Accessibility privileges, created VPN profiles, and persistent WebSocket traffic

6. Success and Failure Conditions

Success Conditions

• The victim installs an out-of-store APK
• Permissions such as Accessibility, screen display, and VPN are granted
• The device can communicate with the C2 or dead drop destination
• An overlay corresponding to the target app exists

Failure Conditions and Mitigations

• Block app installations from unknown sources
• Limit Accessibility permissions only to apps required for business
• Block unauthorized apps and APKs signed with unrecognized certificates via MDM
• Block known malicious distribution and C2 destinations, and investigate unauthorized WebSocket connections.

7. What Happens Upon Success

• Theft of credentials, PINs, and input data for banking and cryptocurrency services
• Continuous monitoring of the device screen and UI structure
• Remote control by attackers and support for unauthorized transfers
• Interference with protective functions and prevention of removal

8. Observable Logs

Email

• Email vectors have not been confirmed in primary sources

Proxy / SWG / DNS

• DNS/HTTP traffic to tvtap-hd[.]app, tvtap-liveapp[.]com, bnbnhura[.]top, etc.
• Long-duration WebSocket connections from Android devices to unknown hosts
• Timeline showing connection to a new C2 immediately following Telegram-related traffic

Endpoint / EDR

• Installation of APKs signed with unrecognized certificates
• Accessibility service registration and privilege assignment
• Creation of local VPN profiles
• Screen overlays, suppression of settings screens, and PackageInstaller calls

Identity / IdP

• Potential device changes, anomalous IPs, and additional authentication failures in banking and cryptocurrency services

SaaS / Cloud

• Where available, review MDM and mobile threat defense telemetry for unauthorized app installations, VPN configurations, and Accessibility settings.

Network

• Periodic traffic to WebSocket/HTTP C2
• Unusual failures in Play Protect-related traffic

9. Attack Success Determination

Confirmed via Public Information

• Confirmed Sample Features and Operating Infrastructure: Group-IB analyzed sample installation and behavior, active distribution/C2 infrastructure, and overlays for over 30 targets. This confirmation cannot be generalized to successful credential theft or unauthorized transfers for individual victims. Scope: Group-IB sample and infrastructure analysis. The number of infected devices and the extent of financial losses have not been disclosed.

10. Investigation Playbook

Trigger

• Any of the following: unknown APK, granted Accessibility, unauthorized VPN, or target IoC communication

Initial Verification

• Save the APK hash, signing certificate, and source
• Record permissions, Device Admin, Accessibility, and VPN settings
• Correlate C2 connection time with banking app usage time

Device and Server

• Check installed packages, overlay permissions, running services, and WebSocket connections
• Distinguish between access permissions to screen/input data and actual evidence of theft to identify potentially exposed information

Authentication and Cloud

• Check banking, cryptocurrency, and email sessions and MFA registrations
• Change credentials from a non-compromised device and invalidate existing sessions

Subsequent Operations

• Check for unauthorized transfers, wallet withdrawals, suppression of SMS/notifications, and abuse of contacts

Containment

• Isolate the device from the network and preserve APK, permissions, and communication logs. Since factory resets wipe device data, decide after securing evidence and necessary business data.
• Block distribution and C2 domains, and restrict unknown APKs and Accessibility via MDM

Judgment Classification

• Separately substantiate connection to distribution sources, payload execution and privilege assignment, transmission of credentials, and remote unauthorized operations

11. Defense and Detection Ideas

Single Event

• Event where an unauthorized APK registers an Accessibility service
• Creation of a VPN profile by an unknown app

Timeline Correlation

• Verify the timeline of dropper installation -> local VPN startup -> deployment of re-signed payload -> Accessibility permission -> C2 communication

Hunting

• In addition to IoCs, hunt for APKs masquerading as TV streaming, certificates that differ per installation, and long-duration WebSockets

Log Gaps

• APKs, permissions, and VPN changes are often not collected in BYOD environments

Priority Measures

• Prohibit out-of-store apps
• Control Accessibility permissions
• Mobile threat defense and risk-based authentication for financial accounts

12. Facts / Inference / Hypothesis

Facts

• Group-IB reported RemControl as an Android banking Trojan MaaS identified since July 2026.
• Fake distribution pages masquerading as TVTap filter visitors by IP geolocation and User-Agent. Group-IB points to the possibility of malvertising abusing Meta ads, based on Meta Pixel.
• RemControl abuses Android Accessibility to transfer screen/UI trees, perform remote gestures, input text, log keys, and display overlays.
• Local VPNs on the device block Google Play Protect-related traffic, and different signing certificates are used for each installation.
• Overlays for over 30 banking and cryptocurrency services have been confirmed, targeting financial institutions in Europe, the Middle East, and Canada, with Italy and France identified as the main targets.
• C2 uses WebSocket as the primary channel and HTTP as the backup, resolving connection destinations from encrypted data on Telegram.
• Group-IB assesses that AI assistance was used to develop the C2 infrastructure and fake screens, noting that the full response of an AI assistant remained inside the distributed overlay HTML.
• The affiliate tag across all analyzed samples was UNKK. Group-IB pointed out similarities with Medusa's UNKN but did not make a definitive attribution to the same operator.

Inference

• Per-installation signing certificates and multi-stage communication destination resolution shorten the lifespan of detections relying solely on static IoCs.
• Droppers supporting over 30 languages and dynamic target lists enable regional expansion, though no activity targeting Japan has been confirmed.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in "Unknowns and Further Investigation".

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Rationale
T1417.002	Input Capture: GUI Input Capture	high	ATT&CK Mobile. Functionality to capture input data by overlaying fake screens on banking apps.
T1437.001	Application Layer Protocol: Web Protocols	high	ATT&CK Mobile. C2 communication via WebSocket and HTTP.

14. Unknowns and Further Investigation

• Number of infected devices and total financial loss
• Relationship between UNKK and known Android malware operators
• Presence of overlays targeted at Japan
• Update frequency of dead drop information and C2

15. Impact on SOCs and Organizations

Although targeting of users in Japan has not been confirmed, organizations allowing Android BYOD should correlate telemetry for out-of-store APKs, Accessibility, and unauthorized VPNs. Financial and cryptocurrency-related enterprises should assume credential compromise originating from customer devices and combine device risk with transaction anomalies.

16. Target-Specific Summary

SOC

Correlate unknown APKs, Accessibility, VPN creation, and WebSocket traffic in a timeline, and track authentication anomalies following credential theft.

Administrators

Prohibit out-of-store APKs and unnecessary Accessibility, and control unauthorized VPNs via MDM.

General Users

Do not install unofficial TV streaming APKs via ads, and carefully verify permission requests for Accessibility and VPNs.