RemControl, a new Android banking malware-as-a-service platform, targets users in Europe and Canada through malvertising campaigns impersonating the TVTap IPTV app. The malware uses over 30 phishing overlays to steal banking credentials and can perform remote actions including screenshot capture and keystroke logging. It evades detection by blocking Google Play Protect and uses Telegram channels to dynamically rotate its command-and-control infrastructure.