RemControl Android MaaS malvertising-delivered credential theft platform
Malware Activity
Summary
Hide ▲
Show ▼
RemControl, a new Android malware-as-a-service, is being distributed through malvertising and fake Google Play pages impersonating TVTap IPTV, creating a scalable path to banking credential theft. The infrastructure has been active since at least May, and the first samples were seen in July. The malware uses more than 30 phishing overlays and targets users across Europe, Canada, and the Middle East. It can abuse Accessibility Service permissions, block Google Play services, and stream device data back to operators.
Related Happenings
Google Android 17 Advanced Protection restricts AccessibilityService to verified Accessibility Tools
Security Tool/Service
H score26
First: 02.10.2026 11:01
Last: 02.10.2026 11:01
Sources 1
About this happening:
Android 17 is tightening Advanced Protection by restricting AccessibilityService access to verified Accessibility Tools, cutting off a major abuse path used for ...
Google Android 17 Advanced Protection restricts AccessibilityService to verified Accessibility Tools
Security Tool/ServiceAbout this happening: Android 17 is tightening Advanced Protection by restricting AccessibilityService access to verified Accessibility Tools, cutting off a major abuse path used for ...
UNKK RemControl TVTap IPTV malvertising campaign
Campaign
H score35
First: 24.09.2026 00:25
Last: 24.09.2026 00:25
Sources 1
How related:
Victims are lured into downloading RemControl through fake Google Play Store pages impersonating the TVTap IPTV application.
About this happening:
RemControl is an Android banking trojan campaign tied to UNKK that uses fake Google Play Store pages to impersonate TVTap IPTV and push victims through a malic...
UNKK RemControl TVTap IPTV malvertising campaign
CampaignHow related: Victims are lured into downloading RemControl through fake Google Play Store pages impersonating the TVTap IPTV application.
About this happening: RemControl is an Android banking trojan campaign tied to UNKK that uses fake Google Play Store pages to impersonate TVTap IPTV and push victims through a malic...
Latest development: 25.09.2026 12:30
Group-IB says the suspected Russian-speaking operator tracked as UNKK appears to have used an AI assistant to build significant portions of the RemControl command-and-control backend and phishing overlays, and the RemControl C2 panel API documentation was inadvertently exposed during the analysis, giving researchers deep insight into the trojan’s infrastructure.
Mantax Otax Android malware activity
Malware Activity
H score32
First: 11.09.2026 00:40
Last: 11.09.2026 00:40
Sources 1
About this happening:
The Mantax Otax Android malware now combines ransomware and spyware features, putting older Android devices at risk of file encryption, data theft, and harassment....
Mantax Otax Android malware activity
Malware ActivityAbout this happening: The Mantax Otax Android malware now combines ransomware and spyware features, putting older Android devices at risk of file encryption, data theft, and harassment....
StreamRat Android banking trojan with remote-control capabilities
Malware Activity
H score42
First: 02.09.2026 15:22
Last: 02.09.2026 15:22
Sources 1
About this happening:
StreamRat is an Android banking trojan promoted through a fake television-streaming campaign on Meta that targeted Spanish-speaking users in Spain and reached...
StreamRat Android banking trojan with remote-control capabilities
Malware ActivityAbout this happening: StreamRat is an Android banking trojan promoted through a fake television-streaming campaign on Meta that targeted Spanish-speaking users in Spain and reached...
ToxicPanda 2.0 Android malware expands fraud capabilities
Malware Activity
H score29
First: 20.08.2026 13:38
Last: 20.08.2026 13:38
Sources 1
About this happening:
The ToxicPanda (aka TgToxic) Android malware family now ships with 167 remote commands and broader fraud features that raise the risk of credential theft and account takeo...
ToxicPanda 2.0 Android malware expands fraud capabilities
Malware ActivityAbout this happening: The ToxicPanda (aka TgToxic) Android malware family now ships with 167 remote commands and broader fraud features that raise the risk of credential theft and account takeo...
Timeline
-
25.09.2026 12:30 1 articles · 12d ago
Group-IB identifies AI-assisted RemControl C2 backend
Technical Analysis UpdateGroup-IB researchers say the Russian-speaking operator tracked as UNKK appears to have used an AI assistant to build significant portions of the RemControl command and control backend and phishing overlays. The analysis also says the trojan's C2 panel API documentation was inadvertently exposed, giving researchers deeper insight into the malware infrastructure.
Show sources
- RemControl Banking Trojan Gives Attackers Remote Control of Android Devices — www.infosecurity-magazine.com — 25.09.2026 12:30
-
24.09.2026 00:25 2 articles · 13d ago
RemControl Android malware campaigns impersonate TVTap IPTV
Initial DisclosureRemControl, an Android malware-as-a-service platform, is distributed through malvertising and fake Google Play pages impersonating the TVTap IPTV app. Group-IB says the infrastructure has been active since at least May, the first samples were observed in July, and those samples contained more than 30 phishing overlays designed to steal banking credentials. The malware targets users in Europe, Canada, and the Middle East, and at least one Italian campaign used geofencing and mobile User-Agent checks.
Show sources
- New RemControl Android banking malware targets users in Europe and Canada — www.bleepingcomputer.com — 24.09.2026 00:25
- New RemControl Android banking malware targets users in Europe and Canada — www.bleepingcomputer.com — 24.09.2026 00:25