RemControl Android Malware Linked to Campaigns Targeting Europe and Canada

Advertisements and fake Play pages impersonating TVTap

According to the report, RemControl uses malicious advertising campaigns and counterfeit Google Play pages to distribute an Android dropper. If granted Accessibility Service permissions, it can place phishing screens over banking apps, collect credentials and other input, stream screen and interface data, and perform remote actions on a device. The report says the campaigns target users in Italy, France, Spain, Poland, Portugal, Canada, and countries in the Middle East.

The report says RemControl infrastructure had been active since at least May, while its first observed samples appeared in July and included more than 30 banking phishing overlays.

RemControl is now described as a malware-as-a-service platform distributed through fake Google Play pages impersonating TVTap IPTV and targeting users in Europe, Canada, and parts of the Middle East.

The reported platform combines banking phishing overlays with broad Android accessibility controls and mechanisms intended to interfere with Google Play Protect checks. Researchers cited in the report also described infrastructure designed to rotate command-and-control information through Telegram channels.