[REVISION HISTORY]
IPTV piracy and banking malware campaign
Updated 1 time since CLSTR started tracking revisions of this situation.
What changed
2026-09-28 18:41 UTC → 2026-09-29 18:41 UTC ·
added
removed
Spanish authorities, specifically the Guardia Civil, issued a warning regarding pirated IPTV applications used to access paid content for free. Officials noted that these apps, often sourced outside official app stores, serve as vectors for malware and banking fraud by using fake interfaces to capture passwords and biometric data. The Guardia Civil warned that ‘saving the cost of a subscription can cost you all your life savings.’ Subsequent investigations identified a specific malware campaign, known as RemControl, targeting Android users in Spain, Italy, France, Portugal, and Canada. This campaign utilizes a fraudulent version of the IPTV application TVTap, promoted through advertising on Meta social networks. networks to malicious websites that mimic the Google Play Store. The malware employs sophisticated evasion tactics, such as automatically activating a VPN to block Google Play Protect from analyzing its behavior. If accessibility permissions are granted, the malware can record touch inputs inputs, keystrokes, and screen patterns. patterns, and capture continuous screenshots to transmit to command and control servers. Researchers discovered over 30 screen overlay templates on command and control servers designed to mimic legitimate banking and cryptocurrency applications to steal login credentials. To mitigate risks, experts advise users to monitor for unusual device behavior, such as unexpected battery drain or overheating, and to ensure security tools like Google Play Protect remain active.
Versions
- 2026-09-29 18:41 UTC IPTV piracy and banking malware campaign
- 2026-09-28 18:41 UTC IPTV piracy and banking malware campaign
Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.