Fake TVTap downloads install RemControl Android malware that steals bank logins and controls phones
Fake Google Play pages offered TVTap downloads that installed RemControl on Android phones, targeting bank customers in Europe, Canada and Gulf states. Avoid these downloads; if installed, stop banking on the phone and contact your bank from another device.
Do not install TVTap from adverts or websites imitating Google Play, or grant it accessibility permissions. If you installed a suspicious copy, stop using banking apps on that phone and contact your bank through its official number from another device. Remove the suspicious app in Safe Mode; if removal is blocked, ask the phone maker for help resetting it.
What’s happening
Group-IB disclosed RemControl on 23 September after finding Android malware distributed through fake Google Play pages advertising the TVTap television app. Researchers identified fake login screens for more than 30 financial institutions in Italy, France, Spain, Poland, Portugal, Canada and some Gulf states. After users grant powerful accessibility permissions, the malware can steal banking PINs and credentials, record typing, transmit the screen and let criminals operate the phone remotely. It can also obstruct removal and use a local VPN to interfere with Google Play Protect during installation. These were observed criminal campaigns, although the reports did not disclose victim totals or confirmed financial losses. This is a malicious-download scam with no software patch to apply. As of 3 November, the reviewed reporting did not establish a confirmed takedown, recovery of stolen money or an end to the campaign.
- What
- Scam
- Affects
- Android phones installing fake TVTap IPTV downloads
- Fixed in
- Nothing to patch
- Since
- 23 Sept 2026
- Closed
- 23 Sept 2026
Timeline
- Made publicNothing to patch
Group-IB disclosed fake Google Play pages impersonating TVTap and confirmed malicious advertising as a delivery channel. It identified fake banking screens targeting more than 30 financial institutions.
- Update
The first RemControl samples were submitted to VirusTotal. This establishes observed malware activity, rather than the date the campaign necessarily began.
- Update
Two principal domains used for fake TVTap downloads were registered, according to Group-IB.
- Update
A domain later used by RemControl's control infrastructure was registered. Group-IB identified this as preparation preceding the first observed malware samples.
Sources
- RemControl: AI Built the Overlays. Victims Lose their PINsGroup-IB · 23 Sept 2026
- New Android malware RemControl steals banking PINs and blocks removal attemptsHelp Net Security · 24 Sept 2026
- New RemControl Android banking malware targets users in Europe and CanadaBleepingComputer · 23 Sept 2026