New Android Banking Trojan Uses AI-Built Overlays to Steal Users’ Banking PINs

A new Android banking trojan is turning an app download into a banking PIN trap. Called RemControl, it hides behind fake download pages for a television streaming app, then waits for banking apps to open.

The campaign uses pages that look like Google Play listings, even though the streaming app is not offered there.

In one Italian campaign, the pages delivered the malicious installer only to Android visitors with Italian IP addresses, hiding the trap from others. Researchers from Group-IB identified RemControl and traced its activity to samples first seen in July 2026.

Group-IB said in a report shared with Cyber Security News (CSN) that more than 30 banking institutions across Europe, the Middle East and Canada have matching phishing screens.

No victim count is confirmed; while the Italy and France were the main targets observed. The discovery adds to concerns about fake streaming app downloads used to place powerful malware on phones.

RemControl goes further than stealing a login: it can watch the screen, record input and let an operator control an infected device remotely.

New Android Banking Trojan Uses AI-Built Overlays

When a targeted banking app opens, RemControl places a full-screen copy of a bank interface over it. The victim may type a PIN, mobile banking code or card expiry date into the imitation. Once the details are submitted, the fake screen closes and the genuine app reappears.

The fake pages arrive from an attacker-controlled server rather than being stored in the installed app. That lets operators change targets without asking victims to install another file. It resembles the technique used by other Android banking trojans that position false screens over trusted apps.

The unusual detail is AI-assisted development. Investigators found server documentation describing stolen banking details as quiz answers and remote access as parental monitoring. A complete AI assistant reply, including notes and an offer to make more, had been left inside a live phishing page.

Those clues suggest an AI assistant helped build parts of the criminal platform under a misleading description of its purpose. That does not mean the malware uses AI on the phone. The immediate danger is still the convincing screen that asks for sensitive details at the wrong moment.

Installation and Remote Control

The installer first shows a false streaming app update screen. It then asks for VPN permission and uses a local connection to cut off network traffic from the Play Store during installation, interfering with real-time security checks.

Each installation receives a newly generated signing certificate, complicating detection based on previously seen files. After installation, the trojan asks for Android Accessibility access.

It lets malware read the screen, capture screenshots and make taps or swipes for the operator. Similar permission abuse is described in reporting on Perseus banking malware campaigns that also used fake streaming apps.

RemControl can log typed text and inspect a device’s on-screen controls while streaming screenshots. It can also gather information needed to reconstruct an unlock pattern and push users out of settings screens when they try to remove it. These features make the risk broader than a single stolen banking PIN.

The operation resembles a service for other criminals. An exposed control panel offered tools for creating app builds, managing infected devices and viewing captured credentials.

Investigators linked the observed samples to an affiliate label, UNKK, but described a possible connection to another banking malware network as unproven.

The malware fetches its server location through Telegram, allowing operators to change where infected phones connect without rebuilding the app.

Updated overlays help the campaign shift targets. It follows a wider pattern of banking PIN theft attempts that combine deceptive screens with remote phone control.

Users should avoid app downloads offered through links or unfamiliar websites, even when a page resembles an official store.

Review unexpected VPN and Accessibility requests, and never enter banking details into a screen that appears without warning. Anyone who suspects account misuse should contact their bank through official channels.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC