Android malware campaign targets banking credentials via fake IPTV apps

Cybersecurity researchers have identified a sophisticated malware campaign targeting Android users through fraudulent IPTV applications. Using a fake version of the TVTap app, attackers lure victims via advertisements on Meta social networks to malicious websites that mimic the Google Play Store.

The malware, identified as RemControl, employs several evasion techniques to bypass security measures. It automatically activates a VPN to isolate traffic from Google Play Protect, preventing the system from analyzing its behavior. Once installed, the software can abuse accessibility permissions to record keystrokes, detect unlock patterns, and capture continuous screenshots to transmit data to a command and control server.

Additionally, the attackers utilize over 30 screen overlay templates. These fake windows appear over legitimate banking and cryptocurrency applications to capture sensitive login credentials and passwords. The campaign has been observed targeting specific regions, including Spain, Italy, France, Portugal, and Canada.

General guidance for mobile users includes monitoring for unusual device behavior, such as unexpected battery drain, overheating, or apps appearing without installation. Users are advised to verify recent downloads and ensure security tools like Google Play Protect are active.