# IPTV piracy and banking malware campaign

> Live situation record from CLSTR: https://clstr.news/situations/iptv-piracy-and-banking-malware-campaign
> Updated: 2026-09-28T15:01:55.000Z. Sources: 17. Developments: 2.

Spanish authorities, specifically the Guardia Civil, issued a warning regarding pirated IPTV applications used to access paid content for free. Officials noted that these apps, often sourced outside official app stores, serve as vectors for malware and banking fraud by using fake interfaces to capture passwords and biometric data. The Guardia Civil warned that ‘saving the cost of a subscription can cost you all your life savings.’

Subsequent investigations identified a specific malware campaign, known as RemControl, targeting Android users in Spain, Italy, France, Portugal, and Canada. This campaign utilizes a fraudulent version of the IPTV application TVTap, promoted through advertising on Meta social networks to malicious websites that mimic the Google Play Store.

The malware employs sophisticated evasion tactics, such as automatically activating a VPN to block Google Play Protect from analyzing its behavior. If accessibility permissions are granted, the malware can record touch inputs, keystrokes, and screen patterns, and capture continuous screenshots to transmit to command and control servers. Researchers discovered over 30 screen overlay templates designed to mimic legitimate banking and cryptocurrency applications to steal login credentials. 

To mitigate risks, experts advise users to monitor for unusual device behavior, such as unexpected battery drain or overheating, and to ensure security tools like Google Play Protect remain active.

## Timeline

### 2026-09-28: Android malware campaign targets banking credentials via fake IPTV apps

A malware campaign is using fake IPTV apps and social media ads to infect Android devices in Europe and Canada, using RemControl to bypass security and steal banking credentials via screen overlays.

15 sources. https://clstr.news/cluster/android-malware-targets-banking-credentials-via-fake-iptv-app

### 2026-09-14: Guardia Civil warns of banking fraud via pirated IPTV apps

The Spanish Guardia Civil warns that pirated IPTV apps used for free football can contain malware designed to steal banking credentials and drain life savings through fraudulent overlays.

2 sources. https://clstr.news/cluster/guardia-civil-warns-of-banking-fraud-via-pirated-iptv-apps

---
Cite as: IPTV piracy and banking malware campaign. CLSTR, https://clstr.news/situations/iptv-piracy-and-banking-malware-campaign