A new Android banking trojan called RemControl is being distributed through fake Google Play pages pretending to offer the TVTap IPTV app. After victims install it and grant powerful Accessibility permissions, it can place fake login screens over real banking apps and give attackers remote control of the device. This provides a realistic, repeatable social-engineering workflow that can be used for awareness simulations (malicious app install + permission prompts + banking credential capture).
The RemControl campaign begins with a lookalike download page designed to look like Google Play, offering the TVTap IPTV app. Victims who download and install the app are then prompted to grant Accessibility permissions, a step that seems routine but hands the malware deep control over the device. Once granted, RemControl can display phishing overlays on top of legitimate banking apps, log keystrokes, stream the screen to attackers, and enable full remote control of the phone. This turns a simple app install into a complete credential theft and device takeover pipeline, targeting customers of more than 30 banks across Western Europe, the Middle East, and Canada.
The attack works because each step looks plausible in isolation. A fake Play Store page for a popular streaming app doesn't look inherently dangerous, and permission prompts are something Android users are used to clicking through quickly. By the time a fake banking login overlay appears asking the user to "sign in again," the malware is already positioned to capture whatever is typed. RemControl is offered as malware-as-a-service, which suggests the workflow is being packaged and reused rather than built for a single one-off campaign.
The most effective defense is treating app installs and permission prompts as security decisions, not routine taps. Employees and consumers alike should only install apps from official stores and be skeptical of download pages that route around them. Accessibility permission requests deserve particular scrutiny: if an app's stated purpose doesn't require that level of access, denying the request and uninstalling the app is the safer choice. Finally, anyone who sees an unexpected banking login prompt should stop, close the app, and re-open their banking app through its normal, trusted path rather than typing credentials into whatever screen appeared. Techniques like this map to MITRE ATT&CK T1204.002 (user execution of a malicious file) and T1656 (impersonation), both of which rely on the user completing the final step themselves.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It spreads through fake Google Play pages offering the TVTap IPTV app. Once installed, victims are prompted to grant Accessibility permissions, which the malware then abuses.
After Accessibility permissions are granted, it can display phishing overlays on top of banking apps, log keystrokes, stream the screen, and give the operator full remote control of the device.
The campaign targets customers of more than 30 banks across Western Europe, the Middle East, and Canada, meaning any Android user doing personal or work banking on their phone could be affected.
An unexpected request for Accessibility permissions from an app that has no real reason to need them, such as a streaming or IPTV app, is a major warning sign.
You tap a Google Play page for “TVTap IPTV, fast, free streaming”… and that tap just handed over your bank. Behind that fake page is RemControl, an Android banking trojan. You install “TVTap”, and it instantly begs for Accessibility permissions it should never need, then it can watch your screen, log keystrokes, and let someone drive your phone remotely. Later, you open your banking app and a full-screen message pops up: “For your security, please sign in again to continue.” That’s RemControl placing a fake login overlay on top of your real app to grab your credentials while it streams your screen. Here’s the move: if any non-banking app, like a TV or streaming app, asks for Accessibility permissions, stop, deny it, and uninstall the app immediately.
Researchers say the Android banking Trojan “Gigabud” can trick victims into installing a fake app, then create a separate Android work profile and run a cloned banking app inside it. Attackers can perform fraudulent transactions from that cloned app, which may reduce the chance that bank defenses…
Researchers say the Gigabud Android banking trojan now clones a victim’s real banking app into a hidden Android Work Profile, so fraud can happen in a separate space that may not trigger the same malware and fraud signals. Victims are tricked into installing what looks like legitimate apps…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
Researchers describe BraZetsu, a Windows malware framework used by an initial-access broker to turn infected PCs into "access for sale" on a criminal marketplace. While the malware itself is technical, the article includes real-world delivery details pointing to phishing: victims are tricked into…
A weekly threat bulletin highlights a North Korea–linked campaign where attackers posed as AI or blockchain employers to trick IT professionals into getting infected and losing cryptocurrency. It also notes a phishing kit that abuses Microsoft’s legitimate device login flow to gain long-lasting…
Attackers used fake “LastPass Authenticator” and fake macOS LastPass pages on GitHub to trick people into downloading a malicious installer. The campaign relied on SEO so the fraudulent GitHub page appeared near the top of search results, then redirected victims through multiple pages to a download…
