UNKK RemControl TVTap IPTV malvertising campaign
Campaign
Summary
Hide ▲
Show ▼
RemControl is an Android banking trojan campaign tied to UNKK that uses fake Google Play Store pages to impersonate TVTap IPTV and push victims through a malicious install flow. The operation has targeted Android users across Western Europe, the Middle East and Canada since July 2026, with Group-IB saying it has confirmed targeting of more than 30 banking institutions across six countries. The trojan abuses Accessibility Services to gain remote control of devices and steal PIN codes, mobile banking codes, and card expiry dates. Group-IB also says UNKK appears to have used an AI assistant to build parts of the C2 backend and phishing overlays, and that exposed C2 panel API documentation gave researchers insight into the infrastructure.
Related Happenings
RemControl Android MaaS malvertising-delivered credential theft platform
Malware Activity
H score29
First: 24.09.2026 00:25
Last: 24.09.2026 00:25
Sources 1
How related:
The trojan, named RemControl by its operator, has been observed targeting retail banking customers across Western Europe, the Middle East and Canada since July 2026.
About this happening:
RemControl, a new Android malware-as-a-service, is being distributed through malvertising and fake Google Play pages impersonating TVTap IPTV, creating a scala...
RemControl Android MaaS malvertising-delivered credential theft platform
Malware ActivityHow related: The trojan, named RemControl by its operator, has been observed targeting retail banking customers across Western Europe, the Middle East and Canada since July 2026.
About this happening: RemControl, a new Android malware-as-a-service, is being distributed through malvertising and fake Google Play pages impersonating TVTap IPTV, creating a scala...
Latest development: 25.09.2026 12:30
Group-IB researchers say the Russian-speaking operator tracked as UNKK appears to have used an AI assistant to build significant portions of the RemControl command and control backend and phishing overlays. The analysis also says the trojan's C2 panel API documentation was inadvertently exposed, giving researchers deeper insight into the malware infrastructure.
StreamRat Android banking trojan with remote-control capabilities
Malware Activity
H score42
First: 02.09.2026 15:22
Last: 02.09.2026 15:22
Sources 1
About this happening:
StreamRat is an Android banking trojan promoted through a fake television-streaming campaign on Meta that targeted Spanish-speaking users in Spain and reached...
StreamRat Android banking trojan with remote-control capabilities
Malware ActivityAbout this happening: StreamRat is an Android banking trojan promoted through a fake television-streaming campaign on Meta that targeted Spanish-speaking users in Spain and reached...
GoldFactory GoldDigger Android banking campaign targeting South Africa and the U.K.
Campaign
H score41
First: 20.08.2026 13:38
Last: 20.08.2026 13:38
Sources 1
About this happening:
A GoldDigger Android banking campaign is driving mass infections in South Africa and the U.K., using fake airline and shopping apps to steal credentials and trigge...
GoldFactory GoldDigger Android banking campaign targeting South Africa and the U.K.
CampaignAbout this happening: A GoldDigger Android banking campaign is driving mass infections in South Africa and the U.K., using fake airline and shopping apps to steal credentials and trigge...
Manic Android malware activity with offline relay exfiltration
Malware Activity
H score29
First: 20.08.2026 13:02
Last: 20.08.2026 13:02
Sources 1
About this happening:
Manic is an Android malware activity that targets Ukrainian banks, government and identity services, messaging apps, and also Russian and European financial inst...
Manic Android malware activity with offline relay exfiltration
Malware ActivityAbout this happening: Manic is an Android malware activity that targets Ukrainian banks, government and identity services, messaging apps, and also Russian and European financial inst...
WindRelay NFC relay malware deployed with SpyNote RAT
Malware Activity
H score20
First: 12.08.2026 17:30
Last: 12.08.2026 17:30
Sources 1
About this happening:
WindRelay is a previously unseen Android NFC relay malware used with SpyNote RAT in a contactless payment fraud scheme that captured live card data via NFC and rel...
WindRelay NFC relay malware deployed with SpyNote RAT
Malware ActivityAbout this happening: WindRelay is a previously unseen Android NFC relay malware used with SpyNote RAT in a contactless payment fraud scheme that captured live card data via NFC and rel...
Timeline
-
25.09.2026 12:30 1 articles · 12d ago
UNKK uses AI assistant to build RemControl C2 backend
Technical Analysis UpdateGroup-IB says the suspected Russian-speaking operator tracked as UNKK appears to have used an AI assistant to build significant portions of the RemControl command-and-control backend and phishing overlays, and the RemControl C2 panel API documentation was inadvertently exposed during the analysis, giving researchers deep insight into the trojan’s infrastructure.
Show sources
- RemControl Banking Trojan Gives Attackers Remote Control of Android Devices — www.infosecurity-magazine.com — 25.09.2026 12:30
-
24.09.2026 00:25 2 articles · 13d ago
RemControl malvertising campaign impersonates TVTap IPTV
Initial DisclosureGroup-IB described a new Android malware-as-a-service platform called RemControl that uses malvertising to impersonate the TVTap IPTV app through fake Google Play pages. The campaign has been active since at least May, first samples were observed in July with more than 30 phishing overlays designed to steal banking credentials, and at least one Italian campaign used geofencing and mobile User-Agent checks. The operation targets Android users in Europe, Canada, and countries in the Middle East, and the operator is tracked as UNKK.
Show sources
- New RemControl Android banking malware targets users in Europe and Canada — www.bleepingcomputer.com — 24.09.2026 00:25
- New RemControl Android banking malware targets users in Europe and Canada — www.bleepingcomputer.com — 24.09.2026 00:25