Researchers at Group-IB have identified a new Android banking trojan, RemControl, which uses Accessibility Services to gain remote control over devices and steal credentials. The malware, which targets over 30 banking institutions, was developed using AI to build its command and control infrastructure and is currently distributed via fake IPTV application updates.
The emergence of RemControl highlights a sophisticated shift in how attackers exploit the streaming ecosystem to compromise mobile security. By impersonating IPTV services like TVTap, threat actors leverage the high demand for third-party video apps to bypass standard OS protections. This development signals a growing trend where malware developers use AI to accelerate the creation of phishing overlays and backend infrastructure, making detection more difficult for automated systems. For the streaming industry, this underscores the reputational risk when legitimate-looking video platforms are used as vectors for financial fraud. Watch for whether Google implements stricter Accessibility Service API restrictions to counter these VPN-based suppression tactics.
The FTC impersonation fraud rule provides a potential regulatory framework for addressing the deceptive tactics used by the RemControl operators. These efforts to combat AI-driven cryptographic vulnerabilities are increasingly vital as malware authors adopt advanced automation, a concern echoed by Europol regarding generative AI security. The 911 S5 botnet VPN malware serves as a recent example of how residential proxy networks are weaponized to facilitate similar large-scale credential theft. As these threats evolve, real-time broadcast piracy regulations updates may offer new standards for identifying synthetic media used in such campaigns.
The RemControl banking trojan is infecting Android devices by impersonating updates for the TVTap IPTV application. Identified by Group-IB, the malware uses AI-generated infrastructure to bypass Google Play Protect. It gains remote control over devices to steal financial credentials, highlighting a sophisticated shift in how attackers exploit streaming apps for fraud.
RemControl is a malicious software targeting Android devices that impersonates updates for the TVTap IPTV application to gain remote control and steal financial credentials.
The malware uses AI-generated infrastructure and launches a local VPN to suppress Google Play Protect, while signing payloads with fresh Android Keystore keys to evade detection.
RemControl targets over 30 banking institutions located across Western Europe, Canada, and the Middle East.
RemControl abuses Android Accessibility Services to capture screen data, perform keylogging, and deploy full-screen WebView overlays to harvest financial information.
Add StreamingMeme as a preferred source on Google to see more of our streaming news at the top of your Search results.
Add as preferred source