Flare Finds BTMOB Android RAT Market Fragmenting Into Resellers and Impersonators
Summary
Flare researchers reviewed thousands of underground posts and found BTMOB’s official Android RAT operation alongside cheaper resellers, source-code vendors, independent operators and possible impersonators. The authenticity of many offers is unverified.
Key points
- Flare researchers examined thousands of posts from forums and chat platforms, tracing BTMOB activity from 2025 through 2026.
- The official channel continued releasing versions and offering access, private servers and source code as the market expanded.
- Former administrators reportedly split off to operate independently, and a Brazilian administrator was said to be maintaining a separate version.
- Repeated Telegram advertisements offered cheaper access, source files and reseller panels; similar wording, prices and contacts suggest coordinated promotion but do not establish who operated the accounts.
- The article says BTMOB is an Android RAT sold as a malware-as-a-service package that includes tools for creating malicious apps, remote control, information theft and phishing.
- Flare could not verify the authenticity of many third-party offers, which may involve genuine reselling, modified versions, repackaged software or scams.
Article Details
- Event Type
- Report on the fragmentation of the BTMOB Android RAT malware-as-a-service market
- Impact
- BTMOB is described as capable of stealing information from victims’ Android phones and enabling remote control, but the article reports no specific victim impact. The ecosystem now includes resellers, independent operators, and possible impersonators offering versions and source code of uncertain authenticity, making it harder to identify a single operator or reliable service. Flare researchers report that the apparent official operation continued releasing versions through April 2026.