Security1 publisher2 min readPublished Updated
Meta ads steer Android users to fake Google Play pages carrying the RemControl banking trojan
Group-IB says the RemControl Android banking trojan reaches bank customers in six countries and the Middle East via Meta ads and fake Google Play pages. Its server address sits in a Telegram dead-drop, so the operator can move infrastructure without a new build.
The Watch · Security desk
What happened
- RemControl, a previously undocumented Android banking trojan, targets retail bank customers in Italy, France, Spain, Poland, Portugal, the Middle East and Canada.
- Meta ads send users to fake Google Play Store pages that impersonate the TVTap IPTV app and deliver the malware.
- Group-IB says the trojan abuses Android's Accessibility Service to overlay phishing screens on banking apps, stream the screen, log keystrokes and give the operator full remote control.
- Z.ai disabled several features of its ZCode coding assistant after a default setting sent users' local code repositories to Alibaba Cloud servers in China without consent.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Blocking a RemControl server only works until the operator repoints the Telegram dead-drop. Network blocklists go stale quickly, so the install step is where defenders can stop it.
- exposure Meta's ad review and Google's brand enforcement are both part of RemControl's delivery path. How fast they remove TVTap lookalikes decides how long the campaign keeps reaching new phones.
- decision Teams approving AI coding assistants now have two cases, months apart, of a default setting that sent source code to vendor-controlled cloud storage. Upload defaults now belong in the approval review.
- precedent If the possible Medusa UNKN link holds, RemControl's delivery methods belong to an affiliate operation and are likely to turn up again behind other app lures.
"C2 address is resolved dynamically through an encrypted Telegram dead-drop, making infrastructure rotation straightforward without recompiling the malware," Group-IB said [6]. An infected phone gets its server address from the dead-drop after it is installed. The operator can move servers without shipping a new build [6]. The trojan was first observed in July 2026 [4].
Group-IB's observed evidence and its inferred evidence are not equally strong. The targets, the delivery path and the capabilities are observed [1][2][5]. The actor is inferred. Russian-language code comments in several overlay HTML files point to a Russian speaker [8]. The research also suggests a possible link to the Medusa UNKN affiliate botnet, based on overlapping campaign naming conventions, delivery mechanisms, the Telegram dead-drop and similar affiliate tags [9]. The link is described as possible, and nothing stronger [9].
The build shows signs of its tooling. Group-IB said the operator panel documentation and phishing overlays "contain artifacts of AI-assisted development, including a complete AI assistant response left verbatim in a live phishing page served to banking victims" [7].
The Hacker News opened its weekly bulletin with the line "This week, the dangerous stuff keeps arriving dressed as something boring." [15] The coding-tool item fits that line, but the problem there came from the vendor's own default. The ZCode upload came a couple of months after SpaceXAI's Grok Build coding CLI was found uploading entire Git repositories to a Google Cloud Storage bucket under its control [11]. Z.ai has since disabled the workflow that generated and uploaded local repository snapshots, and it has opened its codebase for public scrutiny [12]. In both cases the vendor's tool moved the code.
The FBI and CISA covered a third trusted path. Their fact sheet urges critical infrastructure owners to be cautious about giving third-party industrial control system integrators high levels of access, and to apply least privilege [13]. "Not adopting principles such as PoLP could expose owners and operators to malicious cyber actors seeking to compromise critical infrastructure, possibly providing sensitive access to pathways that actors can exploit to cause disruptive and destructive effects to equipment and critical functions," the agencies said [14].
Of the three items, RemControl is the only one that shows an attacker using a channel victims trust. ZCode and Grok Build are cases of vendor defaults, and the FBI and CISA sheet is guidance about standing access [10][11][13].
What to watch
- Whether further analysis confirms or rejects the Medusa UNKN link; confirmation would put RemControl inside an established affiliate operation.
- Whether the campaign swaps TVTap for another impersonated app, or moves off Meta ads, once the current lures are pulled.
- Whether Z.ai's public codebase shows what happened to repository snapshots already uploaded to Alibaba Cloud before the workflow was disabled.