Group-IB Discovers RemControl Android Banking Trojan Using Dynamic Overlay Attacks to Steal Banking PINs
Group-IB has identified a new Android banking trojan named RemControl, with samples observed since July 2026. The malware includes prepared phishing screens for more than 30 financial institutions across Europe, the Middle East, and Canada, with Italy and France serving as the main targets.
The core attack relies on screen overlay. When a victim opens a legitimate banking application, RemControl displays a full-screen replica of that bank’s interface. The user enters the PIN, access code, or card expiry date on the fake screen, which then closes and hands control back to the genuine app without any visible trace of the interception.
The phishing screens are not embedded in the application package. Instead, they are downloaded on demand from servers operated by the threat actors and reachable through Telegram channels. This architecture lets the operators swap targets without needing to redistribute the malware.
Distribution occurs through web pages that imitate Google Play listings for a streaming application. The Italian campaign delivered the installer only to visitors with Italian IP addresses. Each installation uses a unique code-signing certificate to hinder detection.
During installation, the program shows a fake update screen and requests VPN permission. The VPN is used to block traffic to the Play Store and bypass real-time security verification. The malware then asks for Android accessibility permissions. Once granted, operators can read the screen contents, capture screenshots, log typed text, and perform remote taps, including actions that prevent the user from removing the application through settings. The trojan can also reconstruct the device unlock pattern.
Investigators found a leftover AI assistant response inside an active phishing page and documentation that referred to stolen credentials as “quiz responses” and remote access as “parental monitoring.” Group-IB assesses that these artifacts indicate AI assistance during development rather than on-device AI capabilities.
Related articles
Solar and F6 Integrate Solar webProxy with F6 Malware Detonation Platform to Filter Web Threats
GC Solar and F6 have confirmed compatibility between the Solar webProxy web access management system and the F6 Malware Detonation Platform. The integration allows Solar webProxy to pre-filter web objects and forward only suspicious files via the ICAP protocol to F6 MDP for reputation checks, static analysis, and dynamic detonation in an isolated virtual environment. Administrators can tune the level of filtering to avoid sending benign items such as fonts and icons to the sandbox, preserving resources for genuine threats. Data from the Solar webProxy team shows that archives accounted for an average of 37 percent of web threats in 2025, with malware frequently hidden inside ZIP, RAR, and 7Z containers. The solution targets medium and large organizations in finance, industry, and the public sector that handle high volumes of web traffic daily.
Engineer Tackles Jane Street ASIC Reverse Engineering Puzzle with Custom Simulator and Verilog Extraction
A detailed technical account describes how one engineer spent weeks reverse engineering an ASIC from GDS files provided in a Jane Street puzzle. The process began with parsing the GDS layout using the gdstk Python library to identify 27 cells in the warmup challenge and thousands of elements in the main task. The engineer built a custom logic simulator backed by SQLite, developed a domain-specific hardware description language, and eventually extracted a netlist that could be converted into Verilog for simulation. Key components identified included shift registers, an adder, and a comparator named comparitor496 in the warmup round. In the full challenge, nearly 10,000 instances of 81 different sky130 standard cells were processed, revealing an unexpected floating net that prompted a bug report to Jane Street. The effort combined manual schematic tracing, graph-based connectivity analysis, and waveform inspection with Surfer to confirm functional behavior.
EtherHiding Campaign Hides Banking Trojan C2 in Polygon Smart Contracts
Security researchers have detailed the EtherHiding campaign, which conceals command-and-control infrastructure inside smart contracts on the Polygon blockchain. The final payload is a malicious browser extension that functions as a banking trojan, intercepting credentials and two-factor codes from approximately 479 financial and cryptocurrency websites. Instead of embedding fixed addresses in its code, the malware queries an encrypted C2 server address from the smart contract, allowing operators to change destinations through low-cost blockchain transactions that bypass domain blocking. Infection begins when victims visit one of 31 compromised legitimate sites that inject JavaScript displaying a fake CAPTCHA prompt. The prompt instructs users to press Windows+R and execute a PowerShell command, a social engineering technique known as ClickFix that downloads the malicious scripts without exploiting any software vulnerability. The campaign has remained active from November 2025 through at least September 2026, demonstrating the resilience of blockchain-based infrastructure against traditional takedown methods.
Group-IB Uncovers HEAVYGRAM Multi-Stage Windows Spyware Controlled via Telegram Bot API
Researchers at Group-IB have identified 29 new samples of HEAVYGRAM, a sophisticated multi-stage Windows malware designed to target journalists, Iranian dissidents, and government critics. The campaign begins with social engineering lures that deliver archives containing fake Telegram, KeePass, or video editor files, along with WSF, HTA, and Persian-language screensaver payloads. Once executed, the malware uses PowerShell to fetch additional components, establishes persistence through Windows startup mechanisms, and adds its directories to Microsoft Defender exclusions. The core implant, written in Python and packed with PyInstaller, supports DLL side-loading and communicates exclusively through Telegram Bot API to receive commands, capture screenshots, enumerate processes, and exfiltrate data. A particularly damaging capability allows theft of Telegram Desktop session files, enabling account hijacking without password re-entry. Group-IB attributes the operation to the Handala Hack group, linked to the Void Manticore persona also tracked as Storm-0842 and Red Sandstorm, believed to operate on behalf of Iranian intelligence services.