BTMOB has evolved beyond a conventional Android banking trojan into a turnkey fraud platform that lets criminals build branded phishing apps, remotely operate infected phones, and automate theft.
Its emergence illustrates how leaked malware source code and low-code tooling are turning mobile fraud into a scalable franchise.
The malicious lnat-tv-pro.apk sample connected to server[.]yaarsa[.]com/con over WebSocket, exposing the malware’s “BT-v2.5” identifier.
Researchers linked BTMOB to the SpySolr family, with broader lineage pointing back to CraxsRAT.malpedia.caad.fkie.
That ancestry matters. CYFIRMA previously attributed the development of CypherRAT and CraxsRAT to EVLF, also known as EvilWolf or EVLF DEV, a Syria-based malware-as-a-service operator.
The researcher said more than 100 threat actors had purchased licenses for the earlier Android RAT products, providing a ready-made customer base and commercial blueprint for BTMOB’s later expansion.
BTMOB’s most dangerous feature is not merely credential theft. Once a victim sideloads a weaponized application and grants Accessibility Service permissions, operators can remotely manipulate the device, capture keystrokes, take screenshots, harvest files, record audio, unlock screens, and deploy web overlays to steal banking credentials.
WebSocket-based command-and-control enables near-real-time interaction, blurring the boundary between a banking trojan and a full mobile remote-access tool.
The platform’s operator model is designed for criminals with little Android-development knowledge.
Leaked BTMOB packages reportedly include an Android payload, a dropper, a VB.NET desktop panel, PHP/MySQL backend components, and an APK-building workflow.
This architecture allows an operator to customize the application name, icon, server address, permissions, and lure before generating a distributable APK.
Rather than relying on a single malicious package, affiliates can rapidly create localized clones of streaming services, parcel-tracking tools, banking security modules, or social-media applications.
The campaign’s social-engineering layer can then be adjusted to match the target market, language, payment system, and trusted brands.
QuimeraX Researchers said that, BTMOB v2.5 was distributed through a phishing site impersonating Turkish streaming service iNat TV.
BTMob Uses Custom Phishing Apps
BTMOB activity has become particularly relevant in Brazil, where Android banking fraud is already supported by a mature criminal ecosystem.
ESET said its Brazil-focused detections showed BTMOB combines broad remote-access functions with campaign-ready tooling, enabling attackers to exfiltrate data, observe victim activity, and take control of devices rather than only intercept financial transactions.
![Active BTMOB distribution page at meusdownloads[.]site, impersonating the Google Play Store to deliver a fake banking "security module (Source : QuimeraX).](https://blog.quimerax.com/content/images/2026/08/modulodeseguranca.png)
In practice, these campaigns use fake Google Play-style pages, WhatsApp-delivered APKs, delivery-tracking lures, and banking-themed “security updates.”
The attacker’s objective is to persuade victims to sideload an application and approve Accessibility permissions two actions that can effectively hand control of the device to the fraud operator.
The operational shift is significant: the fraudster no longer needs to develop malware, maintain a separate phishing kit, or understand Android packaging.
The site replicates the Play Store’s layout, branding, and install flow, serving spoofed pages for popular Brazilian apps: Nubank, TikTok, and even a fake Gov.BR government service.
![Fake Play Store page impersonating Nubank at playstoreap[.]lovable[.]app (Source : QuimeraX).](https://blog.quimerax.com/content/images/2026/08/nubank.png)
BTMOB’s tooling supplies the payload and delivery customization, while affiliates focus on victim acquisition, vishing, stolen-data enrichment, and cash-out.
Security teams should treat unexpected APK delivery through WhatsApp, SMS, or cloned app-store pages as high-risk, especially where the lure requests installation from unknown sources or Accessibility access.
Accessibility permissions should be restricted and audited because BTMOB relies on them to automate interaction and credential capture.
For defenders, the original BTMOB C2 pattern remains useful: early samples used the yaarsa infrastructure naming and WebSocket communications.
Threat hunters should correlate suspicious Android installations, unexpected Accessibility enablement, outbound WebSocket activity, and domains associated with imitation app portals.
Cyble identified roughly 15 BTMOB v2.5 samples circulating within weeks of its late-January 2025 discovery, indicating active and iterative development from the outset.
BTMOB demonstrates the wider risk of commoditized mobile malware: a capable RAT becomes far more disruptive when it is packaged as a customizable product, resold through affiliates, and delivered through convincing applications that look legitimate to the victim.
Indicators of Compromise
| Indicator | Value |
|---|---|
| Shodan dork (C2) | http.html_hash:-983012381 port:3000 |
| Shodan dork (Bypass panels) | html:"painel de controle elite" |
| html_hash (fake 403, port 3000) | -983012381 |
| C2 port signature | 80 (IIS), 3000 (Node.js/Express), 3306 (MySQL), 8080 (WebSocket), 3389 (RDP) |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now
