Threats Day: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories
Summary: Group-IB reported a previously undocumented Android banking trojan called RemControl targeting retail banking customers in Western Europe, the Middle East, and Canada, distributed through fake Google Play pages impersonating the TVTap IPTV app and reached via Meta ads, with first observation in July 2026. The malware abuses Android's Accessibility Service to inject phishing overlays over banking apps, stream the device screen in real time, log keystrokes, and give the operator full remote control, with its C2 address resolved through an encrypted Telegram dead-drop.
What's compelling: The operator panel documentation and live phishing overlays contain artifacts of AI-assisted development, including a complete AI assistant response left verbatim in a page served to banking victims - the tooling to build credible banking fraud is now cheap enough that its rough edges show up in production.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026