Threat reportMalwareTL-2026-5685

RemControl: Android banking trojan MaaS abusing Accessibility Service, AI-assisted phishing overlays (affiliate UNKK)

highACTIVE

RemControl is an Android banking trojan sold as Malware-as-a-Service and distributed via fake Google Play pages impersonating the TVTap IPTV app, promoted through Meta malvertising. It abuses Accessibility Service for dynamic phishing overlays, screen streaming, keylogging and remote input injection, with overlays for 30+ financial institutions in Italy, France, Spain, Poland, Portugal, Canada and GCC states. First disclosed 2026-09-23.

Key facts

Identifiers	TL-2026-5685
Also known as	RemControl
Severity	HIGH
First disclosed	2026-09-23
Affected products	Google Android (sideloaded APK; Accessibility Service abuse); Retail banking customers Mobile banking apps (30+ institutions in IT, FR, ES, PL, PT, CA, GCC)
Attribution	UNKK (low confidence)
Malware	MEDUSA - S1220, UNKK
Tools	VNC
MITRE ATT&CK techniques	T1204.002 User Execution: Malicious File, T1406 Obfuscated Files or Information, T1406.002 Obfuscated Files or Information: Software Packing, T1417.001 Input Capture: Keylogging, T1417.002 Input Capture: GUI Input Capture, T1426 System Information Discovery, T1437.001 Application Layer Protocol: Web Protocols, T1481.003 Web Service: One-Way Communication, T1513 Screen Capture, T1516 Input Injection, T1521.001 Encrypted Channel: Symmetric Cryptography, T1583.001 Acquire Infrastructure: Domains and 4 more in the attack flow
Motivation	FINANCIAL
Target sectors	finance, banking, consumers
Target regions	italy, france, spain, poland, portugal, canada, GCC states
Detection rules	9 (1 shown free)
Sources	5 cited sources

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5685 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: RemControl Fake TVTap Lure Infrastructure Access — Exploitation Phase

Behaviour-first web proxy search for access to the fake TVTap IPTV 'Google Play' download infrastructure (tvtap-hd.app, tvtap-liveapp.com/dl.php, vpn.doneplay.site, ff-de.shutgpt.ir, vpn.askarzadeh.com, cdn.dlmafi.top, plain-HTTP 216.126.229.216) and instal*tvtap*.apk dropper names used to sideload the RemControl Android banking trojan promoted via Meta malvertising. Covers the initial-access and user-execution stage.

Languages: Splunk SPL, Microsoft KQL, Sigma
ATT&CK: T1660, T1204.002, T1583.001
Data sources: proxy_logs (zscalernss-web), mde_device_network_events, cef_proxy
Severity: high
Confidence: high

Splunk SPL

index=proxy sourcetype="zscalernss-web" earliest=-24h
| eval dest_host=lower(coalesce(host,dest)), full_url=lower(coalesce(url,uri)), client_user=coalesce(login,user,"unknown"), client_ip=coalesce(cip,src_ip) ```Fake TVTap lure infrastructure from the Group-IB RemControl report (TL-2026-5685)```
| where match(dest_host,"(^|\.)(tvtap-hd\.app|tvtap-liveapp\.com|vpn\.doneplay\.site|ff-de\.shutgpt\.ir|vpn\.askarzadeh\.com|cdn\.dlmafi\.top)$") OR dest_host="216.126.229.216" OR like(full_url,"%tvtap-liveapp.com/dl.php%") OR match(full_url,"/instal[^/?]*tvtap[^/?]*\.apk")
| eval ioc_hit=case(match(dest_host,"(^|\.)(tvtap-hd\.app|tvtap-liveapp\.com|vpn\.doneplay\.site|ff-de\.shutgpt\.ir|vpn\.askarzadeh\.com|cdn\.dlmafi\.top)$"),"lure_domain", dest_host="216.126.229.216","lure_ip_http", like(full_url,"%dl.php%"),"dl_php_apk_download", true(),"instal_tvtap_apk_name")
| stats count min(_time) as first_seen max(_time) as last_seen values(ioc_hit) as ioc_hit values(full_url) as urls values(useragent) as user_agents by client_user client_ip dest_host
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Microsoft KQL

let lure_hosts = dynamic(["tvtap-hd.app","tvtap-liveapp.com","vpn.doneplay.site","ff-de.shutgpt.ir","vpn.askarzadeh.com","cdn.dlmafi.top"]);
union
(DeviceNetworkEvents
 | where Timestamp > ago(24h)
 | where RemoteUrl has_any (lure_hosts) or RemoteIP == "216.126.229.216" or RemoteUrl matches regex @"(?i)/instal[^/?]*tvtap[^/?]*\.apk"
 | project TimeGenerated = Timestamp, Device = DeviceName, User = InitiatingProcessAccountName, Url = RemoteUrl, RemoteIP, Source = "MDE-Network"),
(CommonSecurityLog
 | where TimeGenerated > ago(24h)
 | where DestinationHostName has_any (lure_hosts) or RequestURL has_any (lure_hosts) or DestinationIP == "216.126.229.216" or RequestURL matches regex @"(?i)/instal[^/?]*tvtap[^/?]*\.apk"
 | project TimeGenerated, Device = DeviceName, User = SourceUserName, Url = RequestURL, RemoteIP = DestinationIP, Source = "Proxy-CEF")
| sort by TimeGenerated desc

Sigma

title: RemControl Fake TVTap Lure Infrastructure Access
id: 6f1c2a4e-3b7d-4c58-9a21-5d0e8b7a1c01
status: experimental
description: Detects web proxy requests to the fake TVTap IPTV download infrastructure distributing the RemControl Android banking trojan (UNKK affiliate), including the tvtap-liveapp.com dl.php APK download and instal*tvtap*.apk dropper names.
references:
    - https://www.group-ib.com/blog/remcontrol-android-banking-trojan/
    - https://www.bleepingcomputer.com/news/security/new-remcontrol-android-banking-malware-targets-users-in-europe-and-canada/
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.initial-access
    - attack.t1660
    - attack.execution
    - attack.t1204.002
    - attack.resource-development
    - attack.t1583.001
logsource:
    category: proxy
detection:
    selection_host:
        cs-host|endswith:
            - 'tvtap-hd.app'
            - 'tvtap-liveapp.com'
            - 'vpn.doneplay.site'
            - 'ff-de.shutgpt.ir'
            - 'vpn.askarzadeh.com'
            - 'cdn.dlmafi.top'
    selection_ip:
        cs-host: '216.126.229.216'
    selection_dl:
        c-uri|contains: 'tvtap-liveapp.com/dl.php'
    selection_apk:
        c-uri|re: '(?i)/instal[^/?]*tvtap[^/?]*\.apk'
    condition: 1 of selection_*
falsepositives:
    - Security researchers or takedown teams fetching the lure pages
    - Threat-intel sandbox egress
level: high

Known false positives:

Security researchers or sandboxes visiting the lure domains
Legitimate TVTap IPTV users on unmanaged BYOD devices who were lured by the fake pages (still a true infection risk)

Tuning notes: Map proxy field names (host/url/login/cip) to your proxy sourcetype; for non-Zscaler proxies swap the sourcetype (e.g. pan:traffic, bluecoat:proxysg:access:syslog). Exclude known threat-research egress IPs. Feed newly reported TVTap lure domains into the match regex. Consider enriching client_ip with the MDM device owner for fast triage.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)

RemControl instal*tvtap*.apk Dropper File Written — Exploitation Phase · unlock with TL Creds
RemControl Dropper/Payload APK Hash Match — Post-Exploitation Phase · unlock with TL Creds
RemControl Telegram Dead-Drop C2 Resolution — C2 Phase · unlock with TL Creds
RemControl Rotating TVTap-Themed APK Download — Exploitation Phase · unlock with TL Creds
RemControl Debug-Cert Signed Sideloaded Accessibility/VPN App — Post-Exploitation Phase · unlock with TL Creds
RemControl C2, Lure and Community-Related Domain DNS — C2 Phase · unlock with TL Creds
RemControl Sideloaded VPN + Accessibility App Pair — Post-Exploitation Phase · unlock with TL Creds
RemControl C2 Proxy and Operator Panel Web Traffic — C2 Phase · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 31 indicators of compromise for TL-2026-5685.

Sample indicators (3 of 31)

IP address: 216.126.229[.]216
Domain: tvtap-hd[.]app
URL: hxxps://tvtap-liveapp[.]com/dl.php

Defanged, TLP:CLEAR. Full set of 31 indicators: unlock with TL Creds.

31 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

RemControl is a previously undocumented Android banking trojan operated as Malware-as-a-Service (MaaS), analysed by Group-IB (report published 2026-09-23). Its C2 proxy domain bnbnhura.top was registered on 2026-05-12, roughly two months before the first samples; the first samples were submitted to VirusTotal on 2026-07-19. Group-IB tracks the first observed campaigns under the affiliate tag UNKK, found in a Branding class in every sample. Campaign tags seen include IT-NEW, IT-NEW4, FR-NEW, FR-NEW4, pt-v3, ARABIC2 and ARABIC3.

Distribution relies on fake Google Play pages impersonating the TVTap IPTV app, which is not on the official store, so users are used to sideloading it. The pages embed two Meta Pixel IDs, which Group-IB assesses as evidence of paid Meta advertising. An Italian campaign used six distribution URLs with Italian-localized pages that serve the APK only to mobile User-Agents with Italian IP addresses; the final download is a dl.php path on tvtap-liveapp.com. Droppers use the instal*tvtap*.apk naming convention, which was previously seen with Medusa payloads and switched to RemControl payloads around July 2026.

Infection chain: the dropper shows a WebView screen imitating a TVTap update and requests BIND_VPN_SERVICE. It then starts a local VPN that blocks network traffic from com.android.vending, which keeps Play Protect from scanning the install in real time. The dropper generates a fresh signing key in the Android Keystore for each install (certificate subject always CN=Android Debug, O=Android, C=US), so hash- and certificate-based detection fails. It installs and launches the payload through PackageInstaller.SessionParams, and the payload immediately requests Accessibility Service permission. Payload strings are Base64-encoded and XOR-obfuscated; newer payloads use a custom DEX packer whose key derives from the APK signing certificate.

Capabilities: the payload monitors the foreground app against a C2-provided target list and shows a full-screen WebView overlay whose HTML is fetched from the C2 at /overlay/{result_id} and never stored on the device. Overlays collect PINs, mobile banking codes and card expiry dates, and some are multi-step. It streams the screen with takeScreenshot() as WEBP frames over WebSocket, together with a UI node tree as JSON. It logs click, text, focus and selection events across apps. It injects taps, long presses, scrolls, swipes, gestures, text, clipboard and global actions. It reconstructs lock patterns from pattern-view grid coordinates across ten OEM skins. Self-preservation detects app-management, accessibility and factory-reset settings screens in 30+ languages and fires a back action to close them.

C2: on startup the malware fetches one of two Telegram channel pages in round-robin, finds a marker string (numeraZZZas) that appears twice in the HTML, Base64-URL decodes the text between the two occurrences and decrypts it with AES-128-CBC. The key and IV come from the SHA-256 of the marker (first 16 bytes key, last 16 bytes IV). The plaintext is the base C2 URL, so the operator can rotate servers without a new release. The primary channel is WebSocket with a JSON envelope (cmd, udid, rid, data): reg, log, update_apps, apps_report and start_overlay, with 20-second keepalive pings and exponential reconnect backoff of 1 to 30 seconds. The fallback is HTTP POST to /api. About 35 commands are documented.

Infrastructure and MaaS: the RemControl Proxy (bnbnhura.top, behind Cloudflare, FastAPI backend) relays to the final C2 and had publicly exposed API docs. The operator panel (definatelynoone.com and 157.90.179.116) exposed API docs showing bot management, an overlay template editor, a credential results viewer, a macro engine, a VNC session recorder with frame-by-frame replay and a build system with an affiliate tracking field. Each affiliate receives an APK built with configurable lure HTML, app name, accessibility label and package name. Over 100 admin endpoints were listed.

AI assistance and attribution: the proxy and panel API docs describe overlay and credential endpoints as handling 'quiz answers' and the remote-control features as 'parental-monitoring'. A test overlay had a complete AI assistant reply appended to its HTML. Some overlays contain Russian-language comments, so Group-IB assesses the overlay developer as likely Russian-speaking but not necessarily the core malware developer. Overlay images carry Adobe XMP metadata showing a UTC+8 timezone and Photoshop on Windows. Cleafy attributed Medusa samples using the same instal*tvtap*.apk naming to the UNKN affiliate botnet in 2024; UNKN and UNKK differ by one letter and both use Telegram dead-drops and target Italy and France, but Group-IB states a definitive link cannot be established. No CVE is involved and CVSS does not apply; severity is analyst-assigned.

MITRE ATT&CK techniques by tactic:

Remediation

Immediate actions

Block the listed domains, IPs and fake TVTap distribution URLs at DNS, proxy and mobile gateway
Hunt MDM/EDR inventory for sideloaded APKs matching instal*tvtap*.apk and the listed SHA256 hashes
Flag apps holding both BIND_VPN_SERVICE and Accessibility Service permission that are not from an official store
Monitor mobile banking sessions for remote-control, overlay and anomalous session indicators and block them before users enter personal data
Request takedown of fake TVTap Google Play look-alike pages and associated Meta ads

Workarounds

Install apps only from official stores
Deny Accessibility Service requests from apps that do not need them
Run regular Play Protect scans
Never enter PINs, mobile banking codes or card details into unexpected screens; contact the bank through official channels if fraud is suspected

Longer-term hardening

Deploy session monitoring and digital risk protection to detect brand and layout abuse
Run customer awareness on sideloading, IPTV lures and Accessibility permission prompts
Enforce MDM policy blocking installation from unknown sources on managed devices
Do not rely on hash or certificate signatures alone, since each install is re-signed with a new key

Affected and fixed versions

Google — Android (sideloaded APK; Accessibility Service abuse)
Vulnerable versions: Devices that install the malicious TVTap APK and grant Accessibility Service
Retail banking customers — Mobile banking apps (30+ institutions in IT, FR, ES, PL, PT, CA, GCC)
Vulnerable versions: Customers of targeted institutions

Timeline

2026-05-12 RemControl Proxy C2 domain locked-ioc-30 registered, about two months before the first samples; infrastructure reported active from May 2026.
2026-07-01 First RemControl samples observed (July 2026, month precision per Group-IB); instal*tvtap*.apk droppers switch from Medusa to RemControl payloads around this time.
2026-07-10 Distribution domains locked-ioc-29 and tvtap-liveapp.com registered.
2026-07-19 First RemControl samples submitted to VirusTotal.
2026-09-23 Group-IB publishes its RemControl analysis; BleepingComputer covers it the same day.
2026-09-24 Help Net Security reports on RemControl; Infosecurity Magazine and TuttoAndroid follow on 2026-09-25.

Sources cited

RemControl: AI Built the Overlays. Victims Lose their PINs (Group-IB) group-ib.com · Vendor report · 2026-09-23
New RemControl Android banking malware targets users in Europe and Canada (BleepingComputer) BleepingComputer · News · 2026-09-23
New Android malware RemControl steals banking PINs and blocks removal attempts (Help Net Security) Help Net Security · News · 2026-09-24
RemControl Banking Trojan Gives Attackers Remote Control of Android Devices (Infosecurity Magazine) infosecurity-magazine.com · News · 2026-09-25
RemControl, trojan bancario Android (TuttoAndroid) tuttoandroid.net · News · 2026-09-25

RemControl: Android banking trojan MaaS abusing Accessibility Service, AI-assisted phishing overlays (affiliate UNKK)

Key facts

Detection coverage

Free detection: RemControl Fake TVTap Lure Infrastructure Access — Exploitation Phase

Splunk SPL

Microsoft KQL

Sigma

Indicators of compromise

Sample indicators (3 of 31)

Technical analysis

Execution

Defense Evasion

Credential Access

Discovery

Command and Control

Collection

defense-evasion

Resource Development

Exfiltration

Initial Access

Remediation

Immediate actions

Workarounds

Longer-term hardening

Affected and fixed versions

Timeline

Sources cited

More from UNKK

Latest Threats

🔄 Threat Comparison

RemControl: Android banking trojan MaaS abusing Accessibility Service, AI-assisted phishing overlays (affiliate UNKK)

Key facts

Detection coverage

Free detection: RemControl Fake TVTap Lure Infrastructure Access — Exploitation Phase

Splunk SPL

Microsoft KQL

Sigma

Indicators of compromise

Sample indicators (3 of 31)

Technical analysis

Execution

Defense Evasion

Credential Access

Discovery

Command and Control

Collection

defense-evasion

Resource Development

Exfiltration

Initial Access

Remediation

Immediate actions

Workarounds

Longer-term hardening

Affected and fixed versions

Timeline

Sources cited

More in malware

More from UNKK

Latest Threats

🔄 Threat Comparison