Mexico’s financial sector is facing an industrialized phishing Balonx Sistema, a Mexico-focused Phishing-as-a-Service (PhaaS) platform that has harvested credentials and financial data from more than 1,100 banking users since at least October 2025.
The service targets over 20 Mexican financial institutions and combines live phishing, Android malware, and AI-driven voice fraud in one subscription-based operation.
Affiliates rent access on a weekly basis rather than buying a kit outright, allowing the operator identified in the exposed panel and code as “balonx” to retain control over infrastructure, victim sessions, banking templates, and affiliate permissions.
The service reportedly offered an Individual plan for 3,000 MXN per week and an Office plan for 6,000 MXN per week.
The latter supports up to eight Executive sub-accounts, while administrators can limit which banks each affiliate is authorized to target.
Registration is handled through a Telegram bot, approved by the SuperAdmin, while Bitso API integration automates cryptocurrency-based subscription verification.
Balonx’s core capability is a persistent WebSocket connection between the phishing page and an operator control panel.
Instead of collecting credentials through a static webpage, the platform gives fraudsters live visibility into victim activity and the ability to alter the page in real time.
The system exposes 14 fraudulent screen templates, including banking login pages, SMS one-time password prompts, payment-authorization requests, ATM PIN collection, card-data forms, QR card-scanning pages, identity-verification flows, and custom-message windows.
This enables operators to adapt the social-engineering flow as a victim progresses through a bank’s legitimate authentication process.
GroupIB Researchers said that, Balonx Sistema reflects a significant shift from standalone phishing kits toward centrally managed criminal SaaS ecosystems.
The approach is particularly effective against SMS-based MFA. After using stolen credentials to trigger an OTP challenge on the real banking service, an operator can immediately push a matching code-entry screen to the victim.
The victim then unknowingly relays the transaction or login code to the attacker before it expires.
Balonx also distributes a malicious Android application branded as a banking-protection tool.
Researchers identified the APK, known as BankProtect, as a Spyroid-based Android remote access trojan delivered through a fake security alert in the phishing flow.
The application uses the package name sacred.explosion and contains Base64-obfuscated configuration data, including a command-and-control server at 196.251.84[.]11:7771.
Within 12 steady users, the total estimated earnings amount to approximately $1,728,000 MXN, which is equivalent to roughly $99,384.61 USD at current exchange rates.
Once installed, it establishes a persistent connection to the C2 server, giving operators potential access to screen content, keystrokes, SMS messages, and banking-app interactions.
This browser-to-device escalation is crucial: stolen credentials can be supplemented with mobile-device surveillance, making account takeover and transaction fraud more resilient to traditional bank fraud controls.
A parallel module, CallFlow, shows how AI is being embedded into financial-fraud operations.
The platform uses GPT-4o-mini to generate conversational responses, ElevenLabs for synthetic speech, and OpenAI Whisper to transcribe victims’ responses in real time.
The system impersonates a bank representative and operates through FreePBX infrastructure capable of supporting 30 concurrent SIP channels.
By replacing call-center agents with an automated voice pipeline, Balonx removes a major operational bottleneck for vishing crews.
Its AI voice agent can conduct scalable, context-aware calls while steering targets toward phishing links, credential disclosures, OTP capture, or malicious APK installation.
Group-IB linked more than 350 domains to Balonx and the associated “Aclaraciones Bancarias” campaigns.
The operators rotate domains after disruption but retain continuity through a centralized PostgreSQL backend, preserving affiliate data, victim records, and active campaign operations across infrastructure changes.
Financial institutions should prioritize phishing-domain monitoring, real-time detection of WebSocket-based credential collection, APK distribution controls, and customer messaging that warns users that banks will not request OTPs, PINs, or app installations through unsolicited calls or links.
★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…