An AI model’s raw, unedited output accidentally left inside a live phishing page is either sloppy or arrogant. Probably both. But that small slip is what helped researchers piece together one of the more technically alarming Android banking operations seen this year. Security firm Group-IB uncovered a malware-as-a-service platform called RemControl, and if you bank on your Android phone, this one deserves your attention.
The attack starts with targeted ads on Meta platforms. The operators use Meta Pixel tracking IDs, mobile User-Agent checks, and geofencing to push specific users toward fake Google Play Store pages. The bait is TVTap, a well-known free IPTV app. What you actually download is a full banking trojan. That’s a classic social engineering setup, but the delivery is more precise than most. These aren’t spray-and-pray spam campaigns. The targeting is deliberate, aimed at retail banking customers across Spain, Italy, France, Poland, Portugal, Canada, and the Middle East.
The moment the fake app opens, RemControl starts a local VPN service on the device. Not for privacy. To cut off all network traffic to Google Play services, which stops Google Play Protect from running background scans and flagging the malicious file. This same evasion technique recently appeared in new variants of ToxicPanda, a separate malware operation targeting 349 financial and crypto apps across 16 countries. The pattern is becoming a standard playbook move.
Once Play Protect is effectively blind, RemControl asks for Android Accessibility permissions. If granted, the attacker has real control. The malware logs every tap, streams live screen recordings, and captures unlock patterns on devices from Samsung, Xiaomi, Huawei, OPPO, OnePlus, and stock Android. It also blocks uninstall attempts by auto-closing the settings menu the instant you try to open it.
The backend infrastructure uses encrypted Telegram channels as command-and-drop points. Researchers found exposed FastAPI documentation on the initial proxy server, which revealed over 30 custom phishing overlays for different banks. Russian language strings appear throughout the HTML code, and the campaign traces back to an operator called UNKN, linked to the Medusa trojan family.
But RemControl isn’t even the most sophisticated threat in this space right now. Researchers at Zimperium zLabs identified a separate Chinese trojan called RedHat that feeds live screenshots to an onboard AI model. Traditional trojans break when banks update their app layouts because the malware relies on fixed screen coordinates. RedHat reads the UI in real time and figures out exactly where to click. That removes one of the few natural defenses banks have had.
What this combination of threats tells us is straightforward. Malware operators are integrating AI not for novelty but because it makes their tools more reliable and harder to break through normal app updates. For users, the immediate lesson is simple: never install apps from links in social media ads, regardless of how convincing the Play Store page looks. Check the URL. Always.