Balonx PhaaS Steals Bank OTPs in Real Time While AI Calls and Android RAT Target Victims

Mexico’s banking sector is facing a more industrialized fraud threat as the Balonx Sistema phishing-as-a-service (PhaaS) operation combines real-time OTP theft, Android malware, and AI-generated vishing calls.

Balonx is not a conventional credential-harvesting kit. It operates as a subscription-based criminal service that rents access to affiliates, lowering the barrier for telemarketing fraud groups and inexperienced operators to launch convincing banking campaigns.

Its operator reportedly used a Telegram-based registration workflow, approval by a “SuperAdmin,” tiered access plans, affiliate controls and automated cryptocurrency payment validation features more commonly associated with legitimate SaaS products.

The platform was promoted in Facebook groups linked to data trading and telemarketing scams, while exposed GitHub repositories gave researchers a rare view into its infrastructure, victim workflows and domain network.

This visibility revealed a centrally managed fraud ecosystem designed for repeatable, high-volume bank account takeovers.

Balonx’s core capability is a persistent WebSocket channel between the phishing page and the attacker panel. Rather than waiting for a victim to submit a static form, the operator can observe the session and alter the page flow in real time.

After stealing a victim’s banking username and password, an affiliate can attempt authentication against the genuine bank portal.

When the bank issues a one-time password challenge, the phishing operator immediately pushes a matching screen requesting an SMS code, purchase-authorization OTP, cardless-withdrawal code or ATM PIN.

The victim supplies the valid code before it expires, effectively allowing the attacker to complete authentication or approve a fraudulent transaction.

Researchers identified 14 on-demand phishing screens, covering card details, CVV values, transaction approval codes, identity documents, selfies and QR-based card capture.

The kit also enables affiliates to script preconfigured flows for individual banks, automating the progression from login capture to OTP collection.

This design reflects the growing effectiveness of adversary-in-the-middle phishing: MFA remains present, but the attacker manipulates the victim into authorizing the live session.

Balonx, assessed by Group-IB, targets more than 20 Mexican financial institutions and has reportedly collected credentials and financial data from over 1,100 victims since at least October 2025.

Balonx PhaaS Steals Bank OTPs

Similar PhaaS operations increasingly use real-time session handling to defeat SMS- and app-based verification workflows.

Balonx also attempts to move victims from a phishing page to a compromised Android device. Its fake “bank protection” prompts distribute a malicious APK masquerading as a security application.

The malware was linked to the commercial Spyroid remote-access-trojan framework, which can steal SMS messages, capture keystrokes and screens, access files, and monitor banking-app activity.

The APK reportedly maintains a persistent connection to its command-and-control infrastructure, creating an additional path for intercepting banking codes after victims leave the phishing site.

This layer reduces the criminal group’s dependence on a single browser session and creates a longer-lived compromise.

For banks, the combination of web phishing and mobile-device control is particularly concerning. A victim who recognizes a suspicious website too late may still have already installed malware capable of collecting authentication data and supporting follow-on fraud.

A parallel component, dubbed CallFlow, introduces AI-enabled voice fraud. The platform reportedly combines GPT-4o-mini for dialogue generation, ElevenLabs and OpenAI voice services for synthetic speech, Whisper for speech recognition, and FreePBX infrastructure for outbound calls.

The result is an automated fake bank representative capable of conducting live conversations, processing a victim’s reply and generating context-aware follow-up prompts without a human call-center operator.

The workflow can be used to direct targets to Balonx phishing pages, persuade them to disclose OTPs, or pressure them into installing the malicious APK.

This convergence changes the fraud model: phishing links, social engineering, mobile malware and vishing are no longer separate campaigns. They are integrated modules in one affiliate-accessible platform.

Balonx also uses aggressive domain rotation to survive takedowns. Group-IB linked more than 350 domains to Balonx and the related “Aclaraciones Bancarias” campaigns, with centralized backend services preserving affiliate accounts, victim data and active sessions as domains change.

Defenders should prioritize rapid domain and infrastructure correlation, monitor for impersonation pages requesting OTPs or APK installs, and treat unexpected bank calls as untrusted.

Financial institutions should shift toward phishing-resistant authentication, strengthen transaction-risk controls and ensure customers understand that legitimate support teams will not request one-time codes during unsolicited calls.

IOCs

Category	Indicator / Asset	Type	Notes	First Identified
Campaign infrastructure	350+ domains	Domain set	More than 350 domains identified as part of the infrastructure since 2019	Since 2019
Phishing / support portal	aclaraciones-digital[.]online	Domain	Likely themed as a digital clarification or customer-support service	N/A
Phishing / support portal	soporte-aclaracion[.]xyz	Domain	Spanish-language “support/clarification” themed domain	N/A
CallFlow infrastructure	balonx[.]online	Domain	Associated CallFlow infrastructure domain	N/A
Vishing platform	callbalonx[.]info	Domain	CallFlow AI vishing login portal	N/A
PBX backend	panelbalonxfs[.]xyz	Domain	CallFlow FreePBX backend and UCP (User Control Panel)	N/A
Android RAT C2	196.251.84[.]11	IPv4 address	Command-and-control server used by the Android RAT	N/A

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide