Group-IB has identified a new Android banking trojan named RemControl, with samples observed since July 2026. The malware includes prepared phishing screens for more than 30 financial institutions across Europe, the Middle East, and Canada, with Italy and France serving as the main targets.
The core attack relies on screen overlay. When a victim opens a legitimate banking application, RemControl displays a full-screen replica of that bank’s interface. The user enters the PIN, access code, or card expiry date on the fake screen, which then closes and hands control back to the genuine app without any visible trace of the interception.
The phishing screens are not embedded in the application package. Instead, they are downloaded on demand from servers operated by the threat actors and reachable through Telegram channels. This architecture lets the operators swap targets without needing to redistribute the malware.
Distribution occurs through web pages that imitate Google Play listings for a streaming application. The Italian campaign delivered the installer only to visitors with Italian IP addresses. Each installation uses a unique code-signing certificate to hinder detection.
During installation, the program shows a fake update screen and requests VPN permission. The VPN is used to block traffic to the Play Store and bypass real-time security verification. The malware then asks for Android accessibility permissions. Once granted, operators can read the screen contents, capture screenshots, log typed text, and perform remote taps, including actions that prevent the user from removing the application through settings. The trojan can also reconstruct the device unlock pattern.
Investigators found a leftover AI assistant response inside an active phishing page and documentation that referred to stolen credentials as “quiz responses” and remote access as “parental monitoring.” Group-IB assesses that these artifacts indicate AI assistance during development rather than on-device AI capabilities.
