In plain words
Imagine you downloaded an app that looked like a TV remote control, but it actually let someone else control your phone. This is similar to what a new kind of malware called RemControl does. It tricks people into installing a fake TV app, then takes control of their phones to steal banking PINs.
What's broken
RemControl is a type of Android banking trojan¹ that targets customers of more than 30 banks in several countries. It steals banking PINs and blocks attempts to remove it from the phone. The malware was first discovered on July 19, 2026.
How it actually works
RemControl works by tricking victims into installing a fake TV app, which then gives the malware control over the phone. The malware can then steal banking PINs and block attempts to remove it. This is done through a command and control (C2) server², which is a central server that controls the malware. The C2 server sends commands to the malware, which then carries out the commands on the phone.
Proof of concept
It is not clear from the source if there is a public proof-of-concept (PoC)³ for RemControl. A PoC would demonstrate that the malware is real and can be exploited. If a PoC exists, it would sharply raise the urgency for users to take action to protect themselves.
Is it real
It is not clear from the source if RemControl is being actively exploited in the wild. However, the fact that it has been discovered and can steal banking PINs and block removal attempts makes it a significant threat. Users can protect themselves by being cautious when downloading apps and keeping their phones up to date with the latest security patches.
What to do
To protect yourself from RemControl, you should be cautious when downloading apps and keep your phone up to date with the latest security patches. You should also avoid downloading apps from unknown sources and use antivirus software to scan your phone for malware.
Terms
- ¹ Android banking trojan
- , a type of malware that targets Android devices and is designed to steal banking information
- ² command and control (C2) server
- , a central server that controls malware and sends commands to it
- ³ proof-of-concept (PoC)
- , a demonstration that a piece of malware or a vulnerability is real and can be exploited