Security1 publisher2 min readPublished
RemControl's dropper starts a VPN that blocks Play Protect's real-time checks
Group-IB found the Android malware-as-a-service platform in July samples carrying more than 30 banking overlays, delivered through fake Google Play pages for the TVTap IPTV app to users in Europe and Canada.
The Watch · Security desk
What happened
- Group-IB says the RemControl malware-as-a-service infrastructure has been live since at least May, with the first samples seen in July carrying more than 30 banking phishing overlays.
- Victims arrive through fake Google Play pages impersonating the TVTap IPTV app, and at least one Italian campaign used geofencing and mobile User-Agent checks to filter who saw them.
- The targeted users are in Italy, France, Spain, Poland and Portugal, in Canada, and in countries in the Middle East.
- The malware asks for Accessibility Service approval at install, then overlays legitimate banking apps to take PINs, banking codes, card expiry dates and credentials.
- Group-IB tracks the operator as UNKK on the basis of a common identifier in the samples, and suspects a connection to the Medusa banking trojan.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- capability The operator can drive the phone directly with remote taps, swipes, gestures and text injection, so a fraudulent transfer can run inside the victim's own authenticated session instead of from an attacker device.
- precedent Two separate families now ship the Play services traffic block. Defenders should treat the on-device scanner as suppressible for the duration of a sideload.
- constraint Because the C2 address arrives encrypted from Telegram channels, seizing a proxy costs the operator little and any blocklist built on today's endpoints has a short life.
- exposure Pattern-lock capture across Samsung, Xiaomi, Huawei, OPPO and OnePlus handsets puts the device unlock itself in scope, alongside the bank app the victim opened.
RemControl's dropper starts a VPN service and uses it to block traffic from Google Play services. With that traffic blocked, Play Protect cannot perform its real-time checks against known malware [6]. Group-IB says a recent version of ToxicPanda does the same thing [7].
ToxicPanda carries phishing overlays for 349 banking, financial, cryptocurrency and e-wallet applications across 16 countries [7]. The July RemControl samples carried more than 30 [2]. The older operation therefore covers roughly eleven times as many targets [1]. RemControl need not stay at 30: it receives new banking targets from its command-and-control infrastructure on demand [10].
The overlays steal the credentials. The same accessibility service also streams screenshots and the full Android accessibility tree to the operator in real time [11], and records clicks, text changes and focus events across applications [12]. Uninstallation is handled defensively. The malware detects when a victim opens application management, accessibility settings or factory reset, and exits [15].
The malicious download pages carried Meta Pixel tracking IDs, which Group-IB takes as a hint that the operator abused Meta's advertising ecosystem to push victims toward the APK [5].
Group-IB found FastAPI documentation exposed on the initial C2 proxy, listing the endpoints the malware used to fetch banking overlays and submit stolen credentials [17]. Attribution is thinner than the technical picture. The researchers say the origin of the actor is unclear, and point to Russian-language text in the HTML of some overlays as an indication that a Russian speaker wrote at least those [18].
One overlay displayed an AI assistant response. Group-IB calls that a strong indication the kit was built with help from AI models [20].
The advice Group-IB gives users is ordinary: no APKs from outside Google Play unless the publisher is explicitly trusted, regular Play Protect scans, and refusing Accessibility Service prompts from apps that have no accessibility purpose [21]. That scan recommendation applies to a handset where the dropper has already cut Play services off the network [6].
What to watch
- Whether the Play services VPN block turns up in Android families beyond RemControl and ToxicPanda.
- Whether Google changes Play Protect so a locally installed VPN cannot suppress its real-time checks.
- Whether Group-IB firms up or drops the suspected link between UNKK and the Medusa banking trojan.