BTMOB Android RAT Offers Custom Phishing Payloads as a Service

Summary

ESET reports that BTMOB, an Android RAT sold as a service, lets customers build customized phishing payloads. Campaigns mainly target Brazil and Latin America, using fake app pages and Android Accessibility Services.

Key points

BTMOB is an Android remote access trojan offered as a malware-as-a-service platform, according to ESET.
Its builder lets customers customize APK payloads and requested permissions without coding.
The malware can steal data, intercept financial transactions, capture screenshots and remotely control devices.
Distribution includes phishing sites posing as streaming services, cryptocurrency mining platforms and Google Play pages.
ESET says BTMOB is mainly active in Brazil and Latin America; researchers also observed a campaign using an Argentinian government agency as a lure.
After installation, BTMOB abuses Android Accessibility Services to gain additional permissions and system access.
ESET tracks the threat and updates static detection rules; the article recommends installing apps from Google Play, using Play Protect and reviewing risky permissions.

Article Details

Event Type: BTMOB is an Android remote access trojan offered as malware-as-a-service, with a builder for creating customized phishing payloads.
Impact: BTMOB can steal data, intercept financial transactions, capture screenshots, and remotely control devices. It abuses Android Accessibility Services to gain additional permissions and system access. Reported campaigns target users mainly in Brazil and Latin America and have used localized lures, including an Argentinian government agency.