Meta ads steer Android users to fake Google Play pages carrying the RemControl banking trojan
Group-IB says the RemControl Android banking trojan reaches bank customers in six countries and the Middle East via Meta ads and fake Google Play pages. Its server address sits in a Telegram dead-drop, so the operator can move infrastructure without a new build.
The Watch · Security desk
What happened
- RemControl, a previously undocumented Android banking trojan, targets retail bank customers in Italy, France, Spain, Poland, Portugal, the Middle East and Canada.
- Meta ads send users to fake Google Play Store pages that impersonate the TVTap IPTV app and deliver the malware.
- Group-IB says the trojan abuses Android's Accessibility Service to overlay phishing screens on banking apps, stream the screen, log keystrokes and give the operator full remote control.
- Z.ai disabled several features of its ZCode coding assistant after a default setting sent users' local code repositories to Alibaba Cloud servers in China without consent.
Why it matters
- What it limits constraint Blocking a RemControl server only works until the operator repoints the Telegram dead-drop. Network blocklists go stale quickly, so the install step is where defenders can stop it.
- Who's exposed exposure Meta's ad review and Google's brand enforcement are both part of RemControl's delivery path. How fast they remove TVTap lookalikes decides how long the campaign keeps reaching new phones.
- Who has to decide decision Teams approving AI coding assistants now have two cases, months apart, of a default setting that sent source code to vendor-controlled cloud storage. Upload defaults now belong in the approval review.
- What it sets up precedent If the possible Medusa UNKN link holds, RemControl's delivery methods belong to an affiliate operation and are likely to turn up again behind other app lures.
Next story · Security · yesterday
NjRAT-based KGB RAT, sold as a Windows admin tool, has been in development since at least 2022Confirmed2 publishers
"C2 address is resolved dynamically through an encrypted Telegram dead-drop, making infrastructure rotation straightforward without recompiling the malware," Group-IB said [4]. An infected phone gets its server address from the dead-drop after it is installed. The operator can move servers without shipping a new build [4]. The trojan was first observed in July 2026 [6].
Group-IB's observed evidence and its inferred evidence are not equally strong. The targets, the delivery path and the capabilities are observed [1][2][3]. The actor is inferred. Russian-language code comments in several overlay HTML files point to a Russian speaker [7]. The research also suggests a possible link to the Medusa UNKN affiliate botnet, based on overlapping campaign naming conventions, delivery mechanisms, the Telegram dead-drop and similar affiliate tags [15]. The link is described as possible, and nothing stronger [15].
The build shows signs of its tooling. Group-IB said the operator panel documentation and phishing overlays "contain artifacts of AI-assisted development, including a complete AI assistant response left verbatim in a live phishing page served to banking victims" [5].
The Hacker News opened its weekly bulletin with the line "This week, the dangerous stuff keeps arriving dressed as something boring." [14] The coding-tool item fits that line, but the problem there came from the vendor's own default. The ZCode upload came a couple of months after SpaceXAI's Grok Build coding CLI was found uploading entire Git repositories to a Google Cloud Storage bucket under its control [13]. Z.ai has since disabled the workflow that generated and uploaded local repository snapshots, and it has opened its codebase for public scrutiny [9]. In both cases the vendor's tool moved the code.
The FBI and CISA covered a third trusted path. Their fact sheet urges critical infrastructure owners to be cautious about giving third-party industrial control system integrators high levels of access, and to apply least privilege [10]. "Not adopting principles such as PoLP could expose owners and operators to malicious cyber actors seeking to compromise critical infrastructure, possibly providing sensitive access to pathways that actors can exploit to cause disruptive and destructive effects to equipment and critical functions," the agencies said [11].
Of the three items, RemControl is the only one that shows an attacker using a channel victims trust. ZCode and Grok Build are cases of vendor defaults, and the FBI and CISA sheet is guidance about standing access [8][13][10].
What to watch
- Whether further analysis confirms or rejects the Medusa UNKN link; confirmation would put RemControl inside an established affiliate operation.
- Whether the campaign swaps TVTap for another impersonated app, or moves off Meta ads, once the current lures are pulled.
- Whether Z.ai's public codebase shows what happened to repository snapshots already uploaded to Alibaba Cloud before the workflow was disabled.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence65
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence65
Perspective Coverage
4 publishers- Builder
- Builder 34%
- Operator
- Operator 59%
- Investor
- Investor 7%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
RemControl, a previously undocumented Android banking trojan, is targeting retail banking customers across Western Europe (Italy, France, Spain, Poland, Portugal), the Middle East, and Canada.
- [2]
The malware is distributed via fake Google Play Store pages impersonating the TVTap IPTV application, and users are directed to the web page through Meta ads.
- [3]
"The malware abuses Android's Accessibility Service to inject phishing overlays over legitimate banking applications, stream the device screen in real time, log keystrokes, and provide the operator with full remote control over infected devices,"
- [4]
"C2 address is resolved dynamically through an encrypted Telegram dead-drop, making infrastructure rotation straightforward without recompiling the malware."
- [5]
"Both the operator panel documentation and phishing overlays contain artifacts of AI-assisted development, including a complete AI assistant response left verbatim in a live phishing page served to banking victims."
- [6]
RemControl was first observed in July 2026.
- [7]
Russian-language code comments in multiple overlay HTML files indicate the involvement of a Russian speaker.
- [8]
Z.ai disabled several features of its ZCode coding assistant after a default setting was caught sending users' local code repositories to Alibaba Cloud servers in China without their consent.
- [9]
Z.ai has disabled the workflow responsible for generating and uploading local repository snapshots in its ZCode client and opened up its codebase for public scrutiny.
- [10]
The FBI and CISA published a fact sheet urging critical infrastructure owners and operators to maintain caution when granting third-party ICS integrators high levels of access or control over industrial processes and to apply the principle of least privilege.
- [11]
"Not adopting principles such as PoLP could expose owners and operators to malicious cyber actors seeking to compromise critical infrastructure, possibly providing sensitive access to pathways that actors can exploit to cause disruptive and destructive effects to equipment and critical functions,"
- [12]
RemControl's reported target list names six countries plus the Middle East as a region.
- [13]
A couple of months before the ZCode finding, SpaceXAI's Grok Build coding CLI was found uploading entire Git repositories to a Google Cloud Storage bucket under its control.
- [14]
"This week, the dangerous stuff keeps arriving dressed as something boring."
- [15]
Overlapping campaign naming conventions, delivery mechanisms, the use of Telegram dead-drop and affiliate tag similarities suggest a possible link to the Medusa UNKN affiliate botnet.
Sources
4 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comNew RemControl Android banking malware targets users in Europe and Canada
1 article · September 23, 2026
- helpnetsecurity.comNew Android malware RemControl steals banking PINs and blocks removal attempts
1 article · September 24, 2026
- infosecurity-magazine.comRemControl Banking Trojan Gives Attackers Remote Control of Android Devices
1 article · September 25, 2026
- thehackernews.comThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories
2 articles · September 25, 2026
Topics and entities
Topics
- Android Banking Malware
- AI-assisted malware development
- Malvertising
- Malware-as-a-Service