A new Android banking trojan is turning what looks like an innocent streaming-app download into a direct route to victims’ bank accounts. Named RemControl by the researchers who found it, the malware has already been linked to attacks on more than 30 financial institutions across Europe, the Middle East, and Canada — and its backend infrastructure appears to have gotten a helping hand from AI coding tools.

The Bait: A Streaming App That Doesn’t Exist on Google Play

RemControl’s distribution relies on fake download pages designed to closely mimic legitimate Google Play store listings, advertising a television streaming app that isn’t actually available there. Researchers at Group-IB, who identified the campaign and traced it back to samples first seen in July 2026, found that at least one Italian-focused campaign went a step further: the malicious installer was only served to visitors browsing from Italian IP addresses, hiding the operation from security researchers and automated scanners located elsewhere. Italy and France appear to be the primary targets observed so far, though the broader campaign reaches across Europe, the Middle East, and Canada.

How the Overlay Trick Works

Once installed, RemControl requests VPN and Android Accessibility Service permissions — a combination that should immediately raise suspicion for a supposed video-streaming app. With those permissions granted, the malware waits for a legitimate banking app to open, then displays a full-screen overlay that convincingly mimics that bank’s real login interface. Victims type their PIN, mobile banking code, or card expiry date directly into the fake screen; the overlay then closes to reveal the genuine app underneath, leaving the victim with no obvious sign anything went wrong. It’s a technique also seen in the earlier Perseus banking-malware family, refined here with region-specific targeting.

Built to Evade Detection

Beyond the overlay trick, RemControl shows a fair amount of technical polish for a relatively new campaign. It manipulates local network traffic during installation to intercept and bypass the Play Store’s real-time security validation, and each individual installation is signed with a freshly generated certificate — a detail that makes signature-based detection considerably harder, since no two installs necessarily share the same fingerprint. Through continued abuse of Accessibility Services, the trojan can also log keystrokes, monitor the screen persistently, and reconstruct device unlock patterns well beyond the initial credential-theft moment.

An AI Fingerprint in the Criminal Infrastructure

Perhaps the most striking detail in Group-IB’s findings involves the developer notes left behind on the campaign’s own servers. Investigators discovered documentation where stolen banking data had been euphemistically labeled as “quiz answers,” and the malware’s remote-access capability was described internally as “parental monitoring” — likely an attempt to make the toolset look innocuous to anyone who stumbled across it, or even to sidestep AI safety guardrails during development. More notably, researchers found what appear to be complete AI assistant responses, including implementation notes and follow-up offers for further modifications, embedded directly within the live phishing infrastructure — suggesting an AI coding tool was used, under misleading pretenses, to help build parts of the attack platform.

A Criminal-as-a-Service Operation

RemControl’s command-and-control setup adds another layer of resilience: rather than hardcoding server addresses, the malware retrieves its active server location through Telegram dead-drop channels, letting operators redirect infected devices to new infrastructure at will without needing victims to reinstall anything. Group-IB also identified an exposed control panel offering tools to generate customized malware builds, manage infected devices, and harvest stolen credentials — hallmarks of a criminal-as-a-service model where the platform itself may be sold or rented to affiliated operators. Observed samples have been linked to an affiliate label tracked as UNKK.

How to Protect Yourself

Because RemControl spreads through convincing fake app pages rather than exploiting a software vulnerability, user awareness remains the strongest defense:

• Only install apps through the official Google Play Store — never through links from ads, messages, or search results promising an app “not available” on Play.
• Treat any app requesting both VPN and Accessibility Service permissions with serious suspicion unless there’s a clear, legitimate reason for that combination.
• Never enter banking PINs or card details into a login screen that appears unexpectedly or outside your bank’s normal app flow.
• Report suspected account compromise directly through official banking channels rather than any number or link provided within a suspicious app.

No confirmed victim count has been disclosed, but with more than 30 banking institutions already implicated and active distribution ongoing, RemControl is shaping up to be one of the more sophisticated mobile banking threats of the year — and a preview of how AI-assisted development may increasingly show up on the criminal side of the industry as well.