🚨 Fake TV App Can Steal Banking PINs: RemControl Android Malware

Report date: September 24, 2026

Source classification: Verified Emerging Scam Alert

Scam type: Malware-assisted banking fraud / fake Android app download

What happened

Cybersecurity researchers at Group-IB have documented a new Android banking trojan called RemControl. The malware is being distributed through fake Google Play-style pages that impersonate a third-party IPTV application. Independent reporting by Help Net Security describes the same campaign and says customers of more than 30 banks in Europe, Canada, and parts of the Middle East are targeted.

How the scam works

Victims are lured to a convincing fake app-download page and install what appears to be a TV streaming application. The malicious installer can request VPN and Android Accessibility permissions. Researchers say those permissions are then abused to interfere with Google Play Protect checks, place counterfeit banking login screens over legitimate banking apps, capture typed information, stream screenshots, and allow remote interaction with the phone.

RemControl can collect banking PINs, mobile-banking codes and other information entered into targeted apps. Researchers also report that it can obstruct attempts to remove the malware by redirecting users away from settings used to uninstall apps or revoke Accessibility permissions.

Who is being targeted

Group-IB reports targets involving banking customers in Italy, France, Spain, Poland, Portugal, Canada and several Gulf states. The immediate campaign is geographically focused, but the technique matters to Android users generally because unofficial app downloads and fake app-store pages are common malware delivery methods.

Warning signs

• A website that looks like an official app store but was reached through an advertisement, message, or unfamiliar search result.

• An app that is normally unavailable from the official Google Play Store but asks you to install an APK from a website.

• Unexpected requests for Accessibility Service, VPN, screen-control, or permission to install other apps.

• Banking login screens that appear after installing an unrelated entertainment or utility app.

• A phone that prevents you from opening security, Accessibility, uninstall, or reset settings.

What consumers should do

Avoid downloading Android apps from unofficial websites whenever possible. Navigate directly to the developer's known official site or use the official app store. Treat unexpected Accessibility, VPN, screen-control, or install-other-apps requests as high-risk, especially when they come from entertainment or streaming apps.

If you believe a device may be infected, stop using it for banking or other sensitive accounts. From a different trusted device, contact your financial institution using a known official number, review account activity, and change credentials that may have been exposed. Follow your device manufacturer's or a trusted security professional's guidance for safely removing malware or resetting the device.

Why this matters

This campaign combines familiar fake-app social engineering with banking overlays and remote-control capabilities. Group-IB also found evidence that AI tools were used to help build portions of the criminal infrastructure and phishing overlays. The important consumer lesson is simple: a professional-looking download page does not prove an app is safe.

Sources

Primary research: Group-IB, “RemControl: AI Built the Overlays. Victims Lose their PINs,” September 23, 2026 — https://www.group-ib.com/blog/

Independent corroboration: Help Net Security, “New Android malware RemControl steals banking PINs and blocks removal attempts,” September 24, 2026 — https://www.helpnetsecurity.com/2026/09/24/remcontrol-android-banking-trojan-fake-tv-app/

AigiShield

Think it might be a scam? Let AigiShield check it out for you.

Think Before You Click. Verify Before You Trust.