Before the malware installs itself, it asks for permission to set up a VPN. That sounds like a privacy feature. It is the opposite: the dropper behind a newly documented Android banking trojan uses that permission to route all Google Play Store traffic into a null tunnel, cutting Google Play Protect off from the network so it cannot scan what is about to land on the phone.
Group-IB researchers, who published the analysis, call the malware RemControl, the name its own operator uses internally. It had not been documented before. The first samples date to July 2026 and the supporting infrastructure has been live since May.
A scanner that never gets to look
Blocking Play Protect is only the first step. The dropper then generates a fresh signing key in the Android Keystore and signs the payload with it, so no two installations produce the same certificate and detection keyed to a hash or a known signer has nothing to grip. Only then does it hand the payload to Android's own package installer.
Once running, the payload asks for Accessibility Service permissions, the setting Android provides so screen readers can act on what is on screen. Almost every Android banking trojan wants it, because granting it hands over the device. RemControl uses it to draw phishing overlays on genuine banking apps, stream the screen live to the operator, log keystrokes and take remote control. Group-IB counted more than 30 confirmed overlay targets across Italy, France, Spain, Poland, Portugal, Canada and several GCC states.
The panel left its own manual lying open
Victims reach the malware through fake Google Play pages impersonating TVTap, a popular IPTV app that is not on the Play Store, so users are used to hunting for it elsewhere. The pages check the visitor's User-Agent and location and serve the package only to mobile devices in the right country. All six Italian distribution pages carried Meta Pixel code, pointing to paid advertising as a channel.
The more useful find was on the other side. The operator's control panel exposed its own API documentation, laying out the command set, overlay management, affiliate tracking and build infrastructure. That is the shape of a malware as a service platform, not one gang's private tool. Group-IB also reports artifacts of AI assisted development through both the documentation and the overlays, including a complete AI assistant response left verbatim inside a live phishing page being served to banking customers.
The operator behind the first campaigns is tracked as UNKK, from hardcoded affiliate tags present in every analyzed sample, and Russian language comments appear in several overlay files. Group-IB describes a possible link to the Medusa affiliate botnet on overlapping campaign naming and similar tags, and presents it as an overlap rather than an attribution. RemControl resolves its command server through an encrypted Telegram dead drop, so infrastructure can rotate without rebuilding the malware.
What actually stops this on a phone
The practical defences are unglamorous. Install apps from the Play Store app itself, never from a page that merely looks like it, because a convincing web replica is the whole delivery mechanism here. Treat a VPN request from an installer as a stop sign, and treat an Accessibility Service request from anything that is not an accessibility tool the same way. Indicators include tvtap-hd[.]app and tvtap-liveapp[.]com, both registered on 10 July 2026, and 157[.]90[.]179[.]116.
What makes this worth attention is not the overlay theft, which is routine, but the assumption underneath the dropper. Its author treated Play Protect as a network service to be starved rather than a scanner to be outwitted, and built that into the install flow where the user is already tapping through prompts. IntelFusions has tracked the same permission turned against phone owners in Rokarolla's overlay theft across 200 apps.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.