# RemControl Android Banking Trojan Targets Italy and France via Fake TVTap IPTV App

> Group-IB identified RemControl, an Android banking trojan with full remote-access capabilities distributed through fake Google Play Store pages and malvertising impersonating the TVTap IPTV app. It blocks Google Play Protect via a local VPN tunnel, injects phishing overlays across 30+ banking apps primarily in Italy and France, and streams the victim's screen live over WebSocket while an operator drives full remote input.

- **Published:** 2026-09-23T00:00:00Z
- **Last reviewed:** 2026-09-27T02:55:22.634Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2625
- **ID:** TL-2026-2625
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** UNKK
- **Detections:** 9 · **IOCs:** 37 (full data via the Threadlinqs MCP server — Purple tier)

## Description

RemControl is an Android banking trojan first surfaced on VirusTotal on July 19, 2026, distributed via geofenced fake Google Play Store landing pages (localized in Italian, gated by User-Agent and IP geolocation to serve the malicious APK only to Italian mobile IPs) impersonating the TVTap IPTV application, plus Meta Pixel-tracked malvertising (pixel IDs 997470916598588 and 1909605966397328). Distribution domains were registered July 10, 2026, while C2 infrastructure (bnbnhura[.]top) traces back to May 12, 2026, indicating roughly two months of infrastructure staging before public samples appeared.

The dropper abuses the BIND_VPN_SERVICE permission to launch a local VPN tunnel that blocks Google Play Protect from scanning or flagging the payload, and generates a fresh Android Keystore signing key for every installation so that no two installs share a certificate hash, defeating hash-based AV/EDR detection. Strings are obfuscated with Base64 plus XOR.

Once installed, the payload abuses Android's Accessibility Service to inject full-screen phishing overlays over 30+ targeted banking apps, log all keystrokes and UI events, extract pattern-lock grid coordinates across ten OEM Android implementations, and stream the victim's live screen to the operator as WebP frames over WebSocket alongside a JSON serialization of the full accessibility UI tree. The operator can inject taps, swipes, text, and gestures directly, giving VNC-style hands-on-keyboard control of the compromised device. A self-preservation routine watches Accessibility Service navigation events (in 30+ languages) for app-management, accessibility-settings, or factory-reset screens and auto-dismisses them before the victim can act.

Command and control is resolved dynamically through Telegram dead-drop channels (telegram.me/ftestera and a private invite link), with channel content encrypted via AES-128-CBC using SHA-256 marker-derived keys, avoiding hardcoded infrastructure that would require recompilation if seized. The resolved C2 proxy (bnbnhura[.]top) is a FastAPI backend fronted by Cloudflare; the human operator panel is hosted separately at definatelynoone[.]com / 157.90.179.116.

Every analyzed sample carries a hardcoded affiliate tag, UNKK. Group-IB assesses a possible link to the Medusa Android banking botnet's UNKN affiliate program: identical dropper naming convention (instal*tvtap*.apk), shared use of Telegram dead-drop C2 resolution, overlapping Italy/France targeting, a one-character difference between the UNKK and UNKN tags, and Medusa's own distribution activity ceasing around the same period (~July 2026) RemControl appeared. Independent prior reporting on Medusa (Cleafy, PolySwarm, The Hacker News) confirms the UNKN botnet's use of Telegram/X dead-drop resolvers and Accessibility Service abuse against European banking targets, which is consistent with but does not itself confirm the RemControl link. Developer artifacts recovered from the phishing kit (Russian-language HTML comments in the overlay pages; Photoshop asset metadata showing UTC+8 authoring timezone and April 2026 creation dates) provide only circumstantial signal on operator origin and are not treated as confirmed attribution.

Confirmed phishing-overlay targeting spans more than 30 banking apps across Italy (primary, tags IT-NEW/IT-NEW4), France (primary, tags FR-NEW/FR-NEW4), Spain, Poland, Portugal (tag pt-v3), Canada, and GCC member states (tags ARABIC2/ARABIC3).

## MITRE ATT&CK

- T1660 Phishing
- T1655 Masquerading
- T1655.001 Match Legitimate Name or Location
- T1627 Execution Guardrails
- T1627.001 Geofencing
- T1629 Impair Defenses
- T1629.003 Disable or Modify Tools
- T1406 Obfuscated Files or Information
- T1417.001 Keylogging
- T1417.002 GUI Input Capture
- T1513 Screen Capture
- T1418 Software Discovery
- T1516 Input Injection
- T1657 Financial Theft
- T1481.001 Dead Drop Resolver
- T1637 Dynamic Resolution
- T1521 Encrypted Channel
- T1646 Exfiltration Over C2 Channel
- T1406.002 Software Packing
- T1629.001 Prevent Application Removal

## Sources

- [RemControl: Android Banking Trojan Analysis](https://www.group-ib.com/blog/remcontrol-android-banking-trojan/)
- [New Medusa Android Trojan Targets Banking Users Across 7 Countries](https://thehackernews.com/2024/06/new-medusa-android-trojan-targets.html)
- [Cleafy unveils discovery of advanced Android Banking Trojan: Medusa](https://www.cleafy.com/press/cleafy-unveils-medusa-advanced-android-banking-trojan)
- [New Medusa Android Banking Trojan Variant Discovered](https://blog.polyswarm.io/new-medusa-android-banking-trojan-variant-discovered)
- [MITRE ATT&CK Mobile - Financial Theft (T1657)](https://attack.mitre.org/techniques/T1657/)
- [MITRE ATT&CK Mobile - Input Injection (T1516)](https://attack.mitre.org/techniques/T1516/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2625