Watching free football on your phone? This Android malware could steal your bank details

The idea of streaming football matches for free on your smartphone may seem like an easy way to avoid costly subscriptions. However, downloading the wrong app can leave cybercriminals with more than just a football match: your bank details. A malicious malware known as RemControl is using fake streaming apps to trick users into installing surveillance software that can monitor their devices and disrupt banking applications.

On October 14, Spain’s LaLiga warned football fans about the cybersecurity risks associated with illegal streaming services, including the possibility of fraud and data theft.

The warning is in response to a September 23 investigation by cybersecurity firm Group-IB that found RemControl, a banking trojan that targets banks in multiple countries, including Spain.

The malware does not infect you because you watch football online. The danger is that you install a malicious app. Most of the time, this is after you have been directed to a website that looks like a legitimate download site.

How a free football streaming app can put your bank account at risk

The scam begins with an offer that may be too tempting for fans of football to refuse: a free streaming app to watch live matches.

Group-IB reports that criminals have been spreading RemControl by creating fake Google Play download pages for TVTap, a third-party IPTV app.

IPTV, or Internet Protocol Television, is a method of streaming television over the internet. While this technology is legitimate, some services use it to stream illegal sports.

In the attacks investigated by Group-IB, attackers took advantage of the fact that users looking for TVTap were already used to looking outside of Google’s official app store for downloads.

The bogus websites were meant to make the download look legitimate. Some victims were directed to the websites via malicious online ads.

Once the user installed and ran the rogue software, the application could appear to update itself. But in reality, the app attempted to download a more malicious program.

Researchers discovered that the installation process of the app could initiate a local VPN connection to bypass Google Play Protect’s security screening. The malware then attempted to access Android’s Accessibility Service, which allows people to interact with their devices.

In the wrong hands, these privileges can allow criminals to take considerable control over a phone.

The person who thought they were installing an app for football, is instead installing a malicious software that can access sensitive information.

How RemControl can steal banking details from Android phones

RemControl is no ordinary adware. It is a banking trojan, meaning it is specialised malware designed to corrupt banking applications and access sensitive data.

Group-IB has discovered phishing screens targeting over 30 financial institutions in Italy, France, Spain, Poland, Portugal, Canada and various Gulf nations.

Italy and France were the main targets of the first campaigns, but Spanish banking apps were also among the targets.

One of RemControl’s most concerning capabilities is its ability to place a fraudulent screen over a genuine banking app.

The victim may use their usual banking application and find what appears to be a familiar login or verification screen. However, the information they input on this screen could be collected by the attackers.

The malware can also record how users interact with the phone, collect keystrokes, and send the phone’s screen to an operator in real time.

In certain circumstances, it can allow criminals to interact remotely with an infected device. These capabilities could help attackers obtain banking credentials or interfere with financial transactions. However, the researchers’ findings do not establish that every targeted banking customer has suffered a financial loss.

The danger is especially significant since the app can continue running, and the user may think they have just installed a streaming service.

The wider issue has prompted warnings from Spanish football authorities.On October 14, LaLiga highlighted the dangers of malicious software associated with illegal streaming services.

The organisation cautioned that unauthorised applications, suspicious links on social media, and programmes with unnecessary permissions may expose users’ personal and financial data.

LaLiga also mentioned RemControl as a recent example of how rogue IPTV downloads are being used to spread banking malware.

How to protect your Android phone and bank details

There are several warning signs that Android users should recognise before installing a football streaming application.

Google Play-like websites that load in the browser rather than through the official store should raise suspicion, especially if users are being asked to download an APK file.

Be particularly cautious if a streaming app requests access to Android’s Accessibility Service or asks permission to establish a VPN connection. These features have legitimate uses, but they can also be exploited by malicious software.

Spain’s National Cybersecurity Institute, INCIBE, advises downloading files from reliable sources, checking the app permissions and being careful of suspicious links.

Users are also advised to keep their Android and apps up to date. Google Play Protect should be enabled.

The next time you get a strange app that requests your bank passwords, credit card information or your PIN, don’t do it until you’ve double-checked the request.

Any person who thinks that they have installed a malicious streaming app should take this seriously.

Avoid opening banking apps or entering passwords on the device that may be compromised. Contact your bank at once by using its official phone number or other secure devices, especially if you have entered financial information or have noticed suspicious transactions.

Change any passwords that may have been compromised on a secure device and ask your bank for any additional account protection.

Removal of sophisticated malware may require the assistance of a computer expert or a factory reset. If a reset is required, avoid restoring any suspect apps from a backup.