# BTMOB Android Malware Surges as Phishing-Enabled Malware-as-a-Service Platform


Researchers identify sophisticated Android RAT with customizable payload builder, $700 monthly subscription targeting Latin America


Cybersecurity researchers at ESET have identified a rapidly evolving Android remote access trojan (RAT) called BTMOB that is being openly advertised and sold as a malware-as-a-service (MaaS) platform on both the clearweb and private Telegram channels. The malware features an intuitive payload builder that allows even non-technical cybercriminals to create customized phishing campaigns without writing a single line of code, significantly lowering the barrier to entry for mobile-focused attacks across Latin America and beyond.


BTMOB represents a troubling evolution in Android malware distribution, combining ease-of-use with a comprehensive feature set that includes financial transaction interception, screenshot capture, data theft, and full remote device control. The platform's aggressive marketing—with subscription pricing of $700 per month or $5,000 for a lifetime license—suggests an organized, profit-driven operation with significant technical sophistication behind the scenes.


## The Threat: BTMOB's Capabilities and Architecture


BTMOB is a full-featured Android RAT that provides threat actors with an extensive toolkit for compromising mobile devices. Once installed on a victim's phone, the malware can perform a devastating array of malicious functions:


  • Financial fraud: Intercept and manipulate banking transactions and financial app communications
  • Data exfiltration: Steal sensitive personal information, credentials, and private communications
  • Surveillance: Capture screenshots and record user activity without detection
  • Device control: Gain remote access to manipulate the compromised device
  • App manipulation: Disable Google Play Store and hide the malicious application to prevent easy removal
  • Sleep prevention: Force the device to remain active, potentially to drain battery or ensure continuous monitoring

    • What distinguishes BTMOB from earlier Android malware variants is its emphasis on accessibility and customization. The platform includes a dedicated APK payload builder—a user-friendly interface that enables operators to generate custom malware samples tailored to specific phishing campaigns without requiring programming knowledge.


    ## How It Works: Payload Customization and Distribution


    The BTMOB service operates through a builder interface that allows customers to configure the following aspects of their malware payloads:


    | Feature | Purpose |

    |---------|---------|

    | Permission selection | Choose which Android permissions the APK requests |

    | Behavior customization | Define actions (disable Play Store, hide icon, prevent sleep) |

    | Phishing lure integration | Match localized themes and social engineering angles |

    | Campaign targeting | Specify geographic regions and victim profiles |

    | Payload obfuscation | Apply techniques to evade static detection |


    Distribution vectors are equally sophisticated. BTMOB operators create fake Google Play Store portals that appear legitimate to unsuspecting users. Potential victims are directed through phishing links to these fraudulent sites, where they are prompted to download what appears to be a legitimate application—often mimicking popular streaming services, cryptocurrency mining platforms, or government agency portals.


    Recent campaigns documented by security researchers Johnk3r and Merl have exploited regional trust by impersonating Argentinian government agencies, demonstrating that BTMOB operators invest effort in localized social engineering tailored to specific markets.


    Once downloaded and installed, BTMOB exploits Android Accessibility Services to request elevated permissions. This is a critical technique that has become increasingly common in Android malware. Accessibility Services—designed to help users with disabilities navigate their devices—can be abused to grant the malware system-level access and the ability to perform actions without further user interaction or notification.


    ## Background: Evolution of a Regional Threat


    BTMOB is not a newly discovered threat; rather, it represents an evolution of an earlier malware family known as SpySolr. Security researchers at ANYRUN analyzed BTMOB samples in February 2025, and threat intelligence firm Cyble documented its advanced capabilities around the same time. Cyble's analysis in early 2025 identified approximately 15 samples of BTMOB 2.5 within a two-week period, indicating active development and regular updates by the threat actors behind the platform.


    The malware's geographic focus has primarily been Brazil and Latin America, where mobile penetration is high and banking through smartphones is commonplace. However, the platform's open availability and clear marketing suggest potential for expansion into other regions where similar phishing tactics would be effective.


    ## The MaaS Business Model: Democratizing Android Malware


    Perhaps the most concerning aspect of BTMOB is its explicit positioning as a malware-as-a-service platform. Unlike traditional malware that requires technical expertise to deploy, BTMOB uses a subscription-based business model that makes Android malware accessible to a broad range of cybercriminals:


  • Monthly subscription: $700 per month
  • Lifetime license: $5,000 (approximately 7 months of subscription cost)
  • Distribution: Sales conducted through private Telegram channels, indicating a somewhat exclusive but clearly accessible underground marketplace

    • This pricing structure suggests the operators have a confident customer base and expect steady demand. The relatively affordable monthly cost means that even small-scale fraud operations can justify the expense, while larger criminal enterprises can amortize the $5,000 lifetime cost across multiple campaigns and operators.


    The use of Telegram for sales and customer support also reflects modern underground economy practices—the platform offers relative privacy, group coordination capabilities, and a user base that includes thousands of cybercriminals worldwide.


    ## Implications: The Effectiveness Problem


    The rapid generation of new, customized payloads creates a significant defensive challenge. Traditional antivirus solutions and mobile security apps rely heavily on static detection—identifying malware by comparing file signatures and code patterns against known samples. When a malware-as-a-service platform can generate thousands of unique samples within weeks, static detection becomes increasingly ineffective.


    This means that signature-based protections deployed on Android devices and in enterprise Mobile Device Management (MDM) solutions may fail to catch newly generated BTMOB variants. By the time a sample is analyzed and added to detection databases, operators have already created dozens of variations designed to bypass those same defenses.


    ### Who Is at Risk?


    While BTMOB's current focus is Latin America and Brazil, several user populations face elevated risk:


  • Mobile banking users in the region who download apps from sources other than Google Play Store
  • Cryptocurrency users targeted by fake mining app lures
  • Government agency employees in countries where impersonation campaigns are active
  • Users in developing markets where mobile-first banking is prevalent and security awareness may be lower
  • Enterprise employees whose organizations operate in or have customers in affected regions

    • ## Recommendations and Defensive Measures


    Protecting against BTMOB and similar Android malware requires a layered approach that goes beyond traditional signature-based detection:


    For Individual Users:

  • Install apps exclusively from Google Play Store—official channels include additional vetting and Google Play Protect scanning
  • Enable Google Play Protect—the built-in malware scanning service on Android devices
  • Revoke Accessibility permissions for any app that doesn't genuinely need them (check Settings > Accessibility to identify suspicious access)
  • Be cautious with phishing lures—government agencies and major platforms rarely ask users to download apps through unusual channels
  • Verify app sources—cross-check URLs and domain names before downloading; scammers register domains that closely mimic legitimate ones

    • For Organizations:

  • Deploy Mobile Device Management (MDM) solutions that enforce app whitelisting and restrict sideloading
  • Conduct security awareness training specific to mobile threats, particularly if employees are in high-risk regions
  • Monitor for unusual device behavior—excessive data usage, battery drain, or unexpected app permissions
  • Implement behavioral detection alongside signature-based scanning to catch zero-day and rapidly evolving variants
  • Require strong authentication for financial and sensitive mobile apps to prevent unauthorized transactions even if the device is compromised

    • ---


    ## HackWire Analysis


    BTMOB exemplifies a troubling shift in mobile malware economics: the complete democratization of Android attack infrastructure. What was once the domain of well-funded APT groups is now available to anyone with $700 per month and a Telegram account. This represents a fundamental change in the threat landscape that security teams and platforms need to take seriously.


    The broader pattern here is the normalization of malware-as-a-service across all attack surfaces. We've seen this before with ransomware-as-a-service in 2020–2021, with credential-stealing info-stealers in 2023–2024, and now with mobile RATs. Each time, the commoditization of attack infrastructure leads to a spike in both the volume and sophistication of attacks. Defenders get temporarily overwhelmed, and the bar for entry for lower-skilled criminals drops dramatically.


    What's particularly important about BTMOB is that the APK builder represents an attempt to solve the traditional bottleneck in malware distribution—the need for technical skill. By automating payload generation and localizing phishing lures, BTMOB operators have created a product that scales to hundreds of small-to-medium fraud operations simultaneously. This isn't a handful of campaigns using stolen code; this is an organized service designed for volume.


    The reliance on Accessibility Services abuse is also significant. This attack vector has become increasingly mainstream precisely because Google's security model makes it difficult to prevent—Accessibility is a legitimate system feature, and granular permission denial would break the feature's functionality for disabled users. This is a hard problem without easy answers, but it means organizations can't simply block Accessibility Services enterprise-wide without significant usability costs.


    Finally, the focus on Latin America should not lull other regions into complacency. Regional malware thrives in regions where mobile banking penetration is high, law enforcement capacity against cybercrime is limited, and social engineering opportunities are plentiful. As BTMOB matures and its operators gain revenue, expansion into other markets becomes inevitable. The financial incentives are simply too strong.


    For defenders, the key takeaway is that signature-based detection alone will fail against this threat. Behavioral monitoring, app permission auditing, and user education are now table-stakes. —HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Mobile Security](https://www.hackwire.news/category/mobile-security) and [Fraud](https://www.hackwire.news/category/fraud)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)