RemControl trojan targets 30 banks with AI-built overlays
Group-IB has documented RemControl, an Android banking trojan sold as a service whose control panel and fake banking screens were partly written by an AI assistant that thought it was helping build a parental monitoring app.
A newly documented Android banking trojan is doing the rounds in Europe, the Middle East and Canada, and the strangest part of the story is who wrote its paperwork. Group-IB published its analysis of RemControl on 23 September, describing a malware-as-a-service operation whose control panel and fake banking screens carry clear signs of being built with an AI assistant, under the cover story of a parental monitoring app.
What the malware does
RemControl asks for Android's Accessibility Service, the permission almost every Android banking trojan ends up abusing, and then waits for the operator's instructions. When a target banking app comes to the foreground, the device fetches a full-screen fake login page from the control server and draws it over the real application. Nothing is stored on the phone, so the target list can be changed at any time and any infected device can be pointed at a new bank without reinstalling anything.
The intrusion is not limited to fake screens. Group-IB found screen streaming that encodes frames and sends them with a machine-readable map of every visible interface element, keylogging of clicks, text and focus changes across all applications, and the ability to tap, swipe, gesture and type on the victim's behalf. The malware also hunts for pattern-lock grids across ten Android implementations including AOSP, Xiaomi's MIUI, Huawei, OPPO's ColorOS, Samsung's One UI and OnePlus, sends the coordinates of each dot to the server and lets the operator rebuild the unlock pattern.
Getting in, and staying in
Distribution runs through fake Google Play pages impersonating the TVTap IPTV player, an app that is not on Google's store and that users are therefore used to hunting down elsewhere. In the campaign Group-IB examined, pages localised in Italian served the malicious file only to mobile devices on Italian addresses, and the pages carried Meta advertising trackers, suggesting paid malvertising was driving traffic to them.
The install itself is engineered around Google's defences. The dropper routes Google Play Protect traffic into a local VPN tunnel so the scanner has no network, then generates a fresh signing certificate for every installation, which defeats detection based on file hashes or a known certificate. Afterwards it watches for the settings screens people use to remove apps or reset a phone and quietly dismisses them, in more than 30 languages. Its control server address is resolved through an encrypted Telegram post rather than hardcoded, so the infrastructure can be moved without touching the malware.
Group-IB says more than 30 banking institutions are covered by active overlays across Italy, France, Spain, Poland, Portugal, Canada and some GCC member states, with Italy and France the heaviest targets. The operator is tracked as UNKK, and the report notes a possible but unproven link to the UNKN affiliate behind the older Medusa trojan, based on campaign naming, delivery and the shared use of Telegram dead drops.
The AI angle
The detail that will travel furthest is the assistants' paperwork. Group-IB found the panel's own API documentation exposed, complete with build system and affiliate tracking, and found a live phishing page still carrying a full AI assistant response left in the source. The same documentation describes stealing a banking PIN as completing a quiz and describes the victim as someone staring at the quiz, according to the report, which is the language of a developer who believed they were building an app for parents to watch their children's screens.
Our opinion
The scariest sentence in Group-IB's report is not about the trojan. It is that an AI assistant built a working fraud platform, complete with affiliate tracking and build tooling, while apparently believing it was assembling a parental monitoring product. Every refusal an assistant has been trained to give about malware is a refusal about vocabulary, and this is what happens when the vocabulary is laundered in advance.
The rest of RemControl is depressingly familiar: Accessibility abuse, overlays, Play Protect routed into a black hole and a certificate minted per install. None of that is novel, and that is precisely the problem. Android's most powerful accessibility features remain the cheapest way into a banking session, and the drop in effort required to assemble the rest of the kit means the next trojan like this arrives sooner than the last one did.