Polish banks are among more than 30 financial institutions whose apps have been targeted by phishing screens tied to RemControl, an Android banking trojan spread through fake football streaming downloads.
Cybersecurity firm Group-IB reported on 23 September that criminals were distributing RemControl by building fake Google Play pages for TVTap, a third-party IPTV app. IPTV streams television over the internet, and some services use it for illegal sports. People searching for TVTap were already used to looking outside Google’s official store. The bogus sites were designed to look like genuine download pages, and some victims were sent there by malicious online ads.
The risk comes from installing the malicious app. After it is opened, the software can appear to update itself while trying to download a more harmful programme. Researchers found the installation could start a local VPN connection to bypass Google Play Protect, then seek access to Android’s Accessibility Service. Those privileges can give an attacker wide control of the phone and a route to sensitive information.
RemControl is built to interfere with banking apps and reach financial data. Group-IB found phishing screens aimed at institutions in Italy, France, Spain, Poland, Portugal, Canada and several Gulf countries. Italy and France were the main targets of the first campaigns, and Spanish banking apps were also included. The trojan can lay a fraudulent screen over a genuine banking app, so details typed into what looks like a familiar login or verification page may be collected. It can record how the phone is used, collect keystrokes and send the screen to an operator in real time. In some cases it can let criminals operate the infected device remotely. Those functions could help them obtain banking credentials or interfere with transactions. The research does not show that every targeted customer lost money. The app can keep running while the user believes they have only installed a streaming service.
On 14 October, Spain’s LaLiga warned fans about fraud and data theft linked to illegal streaming, and cited RemControl as a recent case of banking malware spread through rogue IPTV downloads. The league said unauthorised apps, suspicious links on social media and programmes that ask for unnecessary permissions can expose personal and financial data.
Spain’s National Cybersecurity Institute, INCIBE, advises downloading from reliable sources, checking app permissions and treating suspicious links with care. Android and its apps should be kept up to date, and Google Play Protect should stay enabled. Pages that imitate Google Play in a browser, especially those offering an APK file, are a warning sign, as are streaming apps that request Accessibility Service access or permission to set up a VPN. A request from an unfamiliar app for bank passwords, card details or a PIN should be checked before anything is entered.
Anyone who thinks they installed a malicious streaming app should avoid opening banking apps or typing passwords on that device. They should contact the bank at once through its official phone number or another secure device, particularly if financial details were entered or suspicious transactions appeared. Passwords that may have been exposed should be changed on a secure device, and the bank can be asked for extra account protection. Removing sophisticated malware may need a specialist or a factory reset. If the phone is reset, suspect apps should not be restored from a backup.