RemControl: AI Built the Overlays. Victims Lose their PINs | Group-IB Blog

Group-IB analyzes RemControl, a new Android banking trojan operating as a MaaS platform used by the UNKK actor to perform overlay-based credential theft, screen streaming, and keylogging with remote control capabilities. Distributed via fake TVTap Google Play Store pages and malvertising, RemControl uses dynamic Telegram-based C2 dead-drops and a proliferating multi-language infrastructure to target 30+ banks across Europe, the Middle East, and Canada, with evidence of AI-assisted development across its components and overlays.