RemControl Android malware uses fake app pages to steal banking credentials

Cybersecurity researchers at Group-IB have identified RemControl, an Android malware service distributed through fake Google Play pages impersonating the TVTap app. The researchers say it targets users in parts of Europe, Canada and the Middle East. Samples observed in July carried more than 30 overlays designed to imitate banking screens and capture credentials. If a user grants Android accessibility permissions, the malware can read on-screen content and input, display credential prompts over legitimate banking apps, and let an operator perform taps and gestures remotely. Its installer also starts a VPN service that blocks Google Play services traffic, interfering with real-time Play Protect checks. The operator's identity remains unclear.