Two new Android banking trojans, one warning sign: the Accessibility permission

Two Android banking malware reports landed in the past three weeks. One describes a new trojan whose target list includes Canadian banking apps. The other is another fake utility on Google Play. They differ in where they come from, but both depend on you granting the same permission, and that’s the part you can control.

RemControl: a fake TV app that takes over your phone

On September 23, Group-IB published research on RemControl, a previously undocumented Android banking trojan sold as a service to other criminals. The first samples date to July 2026, and the infrastructure behind them to May. Group-IB confirmed fake login screens for more than 30 financial institutions across Italy, France, Spain, Poland, Portugal, Canada and some Gulf states, with Italy and France as the main targets so far. It didn’t name the institutions.

It spreads through fake Google Play pages for TVTap, a streaming app that isn’t on the real Play Store, so people are used to downloading it from elsewhere. Group-IB found ad-tracking code on those pages and believes the operator bought ads to drive traffic to them.

Once you install it, according to Group-IB and BleepingComputer:

• the installer briefly cuts the Play Store’s network access, so Google Play Protect can’t check what’s being installed;
• the app then asks for the Accessibility permission;
• with it, the malware covers your banking app with a fake screen to collect your PIN, banking codes or card details, records what you type, streams your screen to the operator and can tap and type on your behalf;
• it can capture your unlock pattern, and it backs out of the settings screens you’d use to remove it or reset the phone.

Group-IB also found signs that parts of the operation were built with an AI assistant, including an assistant’s reply left by mistake at the bottom of a live phishing page.

Anatsa: a PDF reader on Google Play

On October 8, Zscaler ThreatLabz flagged a PDF reader on Google Play with more than 10,000 installs that worked as an installer for Anatsa, a long-running banking trojan also known as TeaBot, Cyber Security News reported. The app’s package name is com.railforge.footplate.documentreader_pdfviewer. The alert didn’t say whether Google had removed the listing, which banks are targeted or how many phones were actually infected; an install count isn’t an infection count.

The pattern is familiar. Earlier Anatsa campaigns used document readers that looked harmless at first, then fetched the banking malware as an “update”. Anatsa has used SMS and Accessibility permissions and fake login screens matched to the banking apps on the phone.

The common thread

Accessibility is meant for tools that help people use their phones, like screen readers. It lets an app read what’s on screen and tap for you. That’s exactly what a banking trojan needs, and Group-IB notes that almost no other app needs it. A request for it from a TV app, PDF reader or “update” is the moment to stop.

What to check on your phone

1. Look at who has Accessibility access. Open Settings → Accessibility and look for installed or downloaded apps (the exact menu names vary by phone maker). Anything you don’t recognize, or that isn’t an accessibility tool you chose, shouldn’t be there.
2. Keep Play Protect on. In the Play Store, tap your profile picture, then Play Protect, and make sure scanning is turned on.
3. Install apps only from the Play Store, and be extra careful with apps that aren’t normally there. If a website or text tells you to download an app or an “update” directly, don’t.
4. Never enter your PIN or card details into a screen that pops up unexpectedly while you’re using your phone. Close the app and open your bank’s app yourself.
5. Install system updates. The Canadian Centre for Cyber Security flagged Android’s October security update on October 6.

If you think it’s too late, call your bank from a different phone, using the number on your card. Group-IB suggests removing the suspicious app in Safe Mode or resetting the device. Then change your banking password from a device you trust, and report fraud to the Canadian Anti-Fraud Centre.

Sources

• Group-IB, RemControl: AI Built the Overlays. Victims Lose their PINs, September 23, 2026
• BleepingComputer, New RemControl Android banking malware targets users in Europe and Canada, September 23, 2026
• Cyber Security News, Malicious PDF Reader With 10,000+ Installs on Google Play Delivers Anatsa Banking Trojan, October 2026 (reporting a Zscaler ThreatLabz alert of October 8)
• Canadian Centre for Cyber Security, Android security advisory – October 2026 monthly rollup (AV26-1003), October 6, 2026
• Google, Use Google Play Protect to help keep your apps safe & your data private
• Canadian Anti-Fraud Centre, antifraudcentre.ca