UNKK

Group-IB researchers discovered RemControl, a previously undocumented Android banking trojan operating as Malware-as-a-Service since May 2026. The malware targets over 30 financial institutions across Western Europe, the Middle East, and Canada through fake TVTap IPTV download pages distributed via malvertising. RemControl abuses Android Accessibility Service to inject phishing overlays, stream device screens in real-time, log keystrokes, and provide full remote control. The investigation revealed that the criminal infrastructure was inadvertently built using AI assistance, with complete AI-generated responses found verbatim in production phishing pages. The C2 panel documentation describes credential theft as quiz completion, suggesting developers deceived AI assistants into building fraud infrastructure under false pretenses. The threat actor UNKK operates the campaigns, with possible links to the Medusa UNKN affiliate botnet based on overlapping infrastructure patterns and naming conventions.