Group-IB researchers identified a new Android malware-as-a-service platform called RemControl, active since May and first sampled in July, that uses over 30 phishing overlays to steal banking credentials. The malware spreads via malvertising campaigns impersonating the TVTap IPTV app, using fake Google Play pages and Meta Pixel tracking, and targets users in Italy, France, Spain, Poland, Portugal, Canada, and parts of the Middle East.
bleepingcomputer.com
· 2026-09-23
Security researchers report that ToxicPanda, an Android banking trojan, has been updated with new capabilities that extend its reach beyond individual financial apps. The revised malware now poses risks to broader enterprise environments, not just personal banking credentials.
darkreading.com
· 2026-08-24
Zimperium researchers found a new version of the ToxicPanda Android malware that requests VPN service permissions to intercept and control device network traffic, allowing it to cut off communication with Google Play and Play Protect. The updated trojan, spread via Amazon AWS-hosted buckets, now supports 167 remote commands and phishing overlays for 349 banking, crypto, and e-wallet apps across 16 countries, plus a separate module that harvests PINs from 140 financial apps.
bleepingcomputer.com
· 2026-08-23
GoKawiil