# RemControl: Android banking trojan MaaS abusing Accessibility Service, AI-assisted phishing overlays (affiliate UNKK)

> RemControl is an Android banking trojan sold as Malware-as-a-Service and distributed via fake Google Play pages impersonating the TVTap IPTV app, promoted through Meta malvertising. It abuses Accessibility Service for dynamic phishing overlays, screen streaming, keylogging and remote input injection, with overlays for 30+ financial institutions in Italy, France, Spain, Poland, Portugal, Canada and GCC states.

- **Published:** 2026-11-10T22:00:42Z
- **Last reviewed:** 2026-11-10T22:00:42Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5685
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5685.png
- **ID:** TL-2026-5685
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** UNKK
- **Detections:** 9 (1 shown free below) · **IOCs:** 31 (3 shown free below)

## Description

RemControl is a previously undocumented Android banking trojan operated as Malware-as-a-Service (MaaS), analysed by Group-IB (report published 2026-09-23). Its C2 proxy domain bnbnhura.top was registered on 2026-05-12, roughly two months before the first samples; the first samples were submitted to VirusTotal on 2026-07-19. Group-IB tracks the first observed campaigns under the affiliate tag UNKK, found in a Branding class in every sample. Campaign tags seen include IT-NEW, IT-NEW4, FR-NEW, FR-NEW4, pt-v3, ARABIC2 and ARABIC3.

Distribution relies on fake Google Play pages impersonating the TVTap IPTV app, which is not on the official store, so users are used to sideloading it. The pages embed two Meta Pixel IDs, which Group-IB assesses as evidence of paid Meta advertising. An Italian campaign used six distribution URLs with Italian-localized pages that serve the APK only to mobile User-Agents with Italian IP addresses; the final download is a dl.php path on tvtap-liveapp.com. Droppers use the instal*tvtap*.apk naming convention, which was previously seen with Medusa payloads and switched to RemControl payloads around July 2026.

Infection chain: the dropper shows a WebView screen imitating a TVTap update and requests BIND_VPN_SERVICE. It then starts a local VPN that blocks network traffic from com.android.vending, which keeps Play Protect from scanning the install in real time. The dropper generates a fresh signing key in the Android Keystore for each install (certificate subject always CN=Android Debug, O=Android, C=US), so hash- and certificate-based detection fails. It installs and launches the payload through PackageInstaller.SessionParams, and the payload immediately requests Accessibility Service permission. Payload strings are Base64-encoded and XOR-obfuscated; newer payloads use a custom DEX packer whose key derives from the APK signing certificate.

Capabilities: the payload monitors the foreground app against a C2-provided target list and shows a full-screen WebView overlay whose HTML is fetched from the C2 at /overlay/{result_id} and never stored on the device. Overlays collect PINs, mobile banking codes and card expiry dates, and some are multi-step. It streams the screen with takeScreenshot() as WEBP frames over WebSocket, together with a UI node tree as JSON. It logs click, text, focus and selection events across apps. It injects taps, long presses, scrolls, swipes, gestures, text, clipboard and global actions. It reconstructs lock patterns from pattern-view grid coordinates across ten OEM skins. Self-preservation detects app-management, accessibility and factory-reset settings screens in 30+ languages and fires a back action to close them.

C2: on startup the malware fetches one of two Telegram channel pages in round-robin, finds a marker string (numeraZZZas) that appears twice in the HTML, Base64-URL decodes the text between the two occurrences and decrypts it with AES-128-CBC. The key and IV come from the SHA-256 of the marker (first 16 bytes key, last 16 bytes IV). The plaintext is the base C2 URL, so the operator can rotate servers without a new release. The primary channel is WebSocket with a JSON envelope (cmd, udid, rid, data): reg, log, update_apps, apps_report and start_overlay, with 20-second keepalive pings and exponential reconnect backoff of 1 to 30 seconds. The fallback is HTTP POST to /api. About 35 commands are documented.

Infrastructure and MaaS: the RemControl Proxy (bnbnhura.top, behind Cloudflare, FastAPI backend) relays to the final C2 and had publicly exposed API docs. The operator panel (definatelynoone.com and 157.90.179.116) exposed API docs showing bot management, an overlay template editor, a credential results viewer, a macro engine, a VNC session recorder with frame-by-frame replay and a build system with an affiliate tracking field. Each affiliate receives an APK built with configurable lure HTML, app name, accessibility label and package name. Over 100 admin endpoints were listed.

AI assistance and attribution: the proxy and panel API docs describe overlay and credential endpoints as handling 'quiz answers' and the remote-control features as 'parental-monitoring'. A test overlay had a complete AI assistant reply appended to its HTML. Some overlays contain Russian-language comments, so Group-IB assesses the overlay developer as likely Russian-speaking but not necessarily the core malware developer. Overlay images carry Adobe XMP metadata showing a UTC+8 timezone and Photoshop on Windows. Cleafy attributed Medusa samples using the same instal*tvtap*.apk naming to the UNKN affiliate botnet in 2024; UNKN and UNKK differ by one letter and both use Telegram dead-drops and target Italy and France, but Group-IB states a definitive link cannot be established. No CVE is involved and CVSS does not apply; severity is analyst-assigned.

## MITRE ATT&CK

- T1660 Phishing
- T1204.002 User Execution: Malicious File
- T1583.001 Acquire Infrastructure: Domains
- T1629.003 Impair Defenses: Disable or Modify Tools
- T1629 Impair Defenses
- T1406 Obfuscated Files or Information
- T1406.002 Obfuscated Files or Information: Software Packing
- T1417.002 Input Capture: GUI Input Capture
- T1417.001 Input Capture: Keylogging
- T1516 Input Injection
- T1513 Screen Capture
- T1426 System Information Discovery
- T1437.001 Application Layer Protocol: Web Protocols
- T1481.003 Web Service: One-Way Communication
- T1521.001 Encrypted Channel: Symmetric Cryptography
- T1646 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**RemControl Fake TVTap Lure Infrastructure Access — Exploitation Phase** (`TL-2026-5685-SPL-001`)

Behaviour-first web proxy search for access to the fake TVTap IPTV 'Google Play' download infrastructure (tvtap-hd.app, tvtap-liveapp.com/dl.php, vpn.doneplay.site, ff-de.shutgpt.ir, vpn.askarzadeh.com, cdn.dlmafi.top, plain-HTTP 216.126.229.216) and instal*tvtap*.apk dropper names used to sideload the RemControl Android banking trojan promoted via Meta malvertising. Covers the initial-access and user-execution stage.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1660, T1204.002, T1583.001
- **Data sources:** proxy_logs (zscalernss-web), mde_device_network_events, cef_proxy
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=proxy sourcetype="zscalernss-web" earliest=-24h
| eval dest_host=lower(coalesce(host,dest)), full_url=lower(coalesce(url,uri)), client_user=coalesce(login,user,"unknown"), client_ip=coalesce(cip,src_ip) ```Fake TVTap lure infrastructure from the Group-IB RemControl report (TL-2026-5685)```
| where match(dest_host,"(^|\.)(tvtap-hd\.app|tvtap-liveapp\.com|vpn\.doneplay\.site|ff-de\.shutgpt\.ir|vpn\.askarzadeh\.com|cdn\.dlmafi\.top)$") OR dest_host="216.126.229.216" OR like(full_url,"%tvtap-liveapp.com/dl.php%") OR match(full_url,"/instal[^/?]*tvtap[^/?]*\.apk")
| eval ioc_hit=case(match(dest_host,"(^|\.)(tvtap-hd\.app|tvtap-liveapp\.com|vpn\.doneplay\.site|ff-de\.shutgpt\.ir|vpn\.askarzadeh\.com|cdn\.dlmafi\.top)$"),"lure_domain", dest_host="216.126.229.216","lure_ip_http", like(full_url,"%dl.php%"),"dl_php_apk_download", true(),"instal_tvtap_apk_name")
| stats count min(_time) as first_seen max(_time) as last_seen values(ioc_hit) as ioc_hit values(full_url) as urls values(useragent) as user_agents by client_user client_ip dest_host
| convert ctime(first_seen) ctime(last_seen)
| sort - count
````

### Microsoft KQL

```kql
let lure_hosts = dynamic(["tvtap-hd.app","tvtap-liveapp.com","vpn.doneplay.site","ff-de.shutgpt.ir","vpn.askarzadeh.com","cdn.dlmafi.top"]);
union
(DeviceNetworkEvents
 | where Timestamp > ago(24h)
 | where RemoteUrl has_any (lure_hosts) or RemoteIP == "216.126.229.216" or RemoteUrl matches regex @"(?i)/instal[^/?]*tvtap[^/?]*\.apk"
 | project TimeGenerated = Timestamp, Device = DeviceName, User = InitiatingProcessAccountName, Url = RemoteUrl, RemoteIP, Source = "MDE-Network"),
(CommonSecurityLog
 | where TimeGenerated > ago(24h)
 | where DestinationHostName has_any (lure_hosts) or RequestURL has_any (lure_hosts) or DestinationIP == "216.126.229.216" or RequestURL matches regex @"(?i)/instal[^/?]*tvtap[^/?]*\.apk"
 | project TimeGenerated, Device = DeviceName, User = SourceUserName, Url = RequestURL, RemoteIP = DestinationIP, Source = "Proxy-CEF")
| sort by TimeGenerated desc
```

### Sigma

```yaml
title: RemControl Fake TVTap Lure Infrastructure Access
id: 6f1c2a4e-3b7d-4c58-9a21-5d0e8b7a1c01
status: experimental
description: Detects web proxy requests to the fake TVTap IPTV download infrastructure distributing the RemControl Android banking trojan (UNKK affiliate), including the tvtap-liveapp.com dl.php APK download and instal*tvtap*.apk dropper names.
references:
    - https://www.group-ib.com/blog/remcontrol-android-banking-trojan/
    - https://www.bleepingcomputer.com/news/security/new-remcontrol-android-banking-malware-targets-users-in-europe-and-canada/
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.initial-access
    - attack.t1660
    - attack.execution
    - attack.t1204.002
    - attack.resource-development
    - attack.t1583.001
logsource:
    category: proxy
detection:
    selection_host:
        cs-host|endswith:
            - 'tvtap-hd.app'
            - 'tvtap-liveapp.com'
            - 'vpn.doneplay.site'
            - 'ff-de.shutgpt.ir'
            - 'vpn.askarzadeh.com'
            - 'cdn.dlmafi.top'
    selection_ip:
        cs-host: '216.126.229.216'
    selection_dl:
        c-uri|contains: 'tvtap-liveapp.com/dl.php'
    selection_apk:
        c-uri|re: '(?i)/instal[^/?]*tvtap[^/?]*\.apk'
    condition: 1 of selection_*
falsepositives:
    - Security researchers or takedown teams fetching the lure pages
    - Threat-intel sandbox egress
level: high

```

**Known false positives:**

- Security researchers or sandboxes visiting the lure domains
- Legitimate TVTap IPTV users on unmanaged BYOD devices who were lured by the fake pages (still a true infection risk)

**Tuning notes:** Map proxy field names (host/url/login/cip) to your proxy sourcetype; for non-Zscaler proxies swap the sourcetype (e.g. pan:traffic, bluecoat:proxysg:access:syslog). Exclude known threat-research egress IPs. Feed newly reported TVTap lure domains into the match regex. Consider enriching client_ip with the MDM device owner for fast triage.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- RemControl instal*tvtap*.apk Dropper File Written — Exploitation Phase (locked: unlock with TL Creds)
- RemControl Dropper/Payload APK Hash Match — Post-Exploitation Phase (locked: unlock with TL Creds)
- RemControl Telegram Dead-Drop C2 Resolution — C2 Phase (locked: unlock with TL Creds)
- RemControl Rotating TVTap-Themed APK Download — Exploitation Phase (locked: unlock with TL Creds)
- RemControl Debug-Cert Signed Sideloaded Accessibility/VPN App — Post-Exploitation Phase (locked: unlock with TL Creds)
- RemControl C2, Lure and Community-Related Domain DNS — C2 Phase (locked: unlock with TL Creds)
- RemControl Sideloaded VPN + Accessibility App Pair — Post-Exploitation Phase (locked: unlock with TL Creds)
- RemControl C2 Proxy and Operator Panel Web Traffic — C2 Phase (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 31)

Defanged, TLP:CLEAR.

- IP address: `216.126.229[.]216`
- Domain: `tvtap-hd[.]app`
- URL: `hxxps://tvtap-liveapp[.]com/dl.php`

Full set of 31 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [RemControl: AI Built the Overlays. Victims Lose their PINs (Group-IB)](https://www.group-ib.com/blog/remcontrol-android-banking-trojan/)
- [New RemControl Android banking malware targets users in Europe and Canada (BleepingComputer)](https://www.bleepingcomputer.com/news/security/new-remcontrol-android-banking-malware-targets-users-in-europe-and-canada/)
- [New Android malware RemControl steals banking PINs and blocks removal attempts (Help Net Security)](https://www.helpnetsecurity.com/2026/09/24/remcontrol-android-banking-trojan-fake-tv-app/)
- [RemControl Banking Trojan Gives Attackers Remote Control of Android Devices (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/banking-trojan-remote-control/)
- [RemControl, trojan bancario Android (TuttoAndroid)](https://www.tuttoandroid.net/news/2026/09/25/remcontrol-trojan-bancario-android-ia-1174348/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5685