Loading story…
Researchers reported that BTMob is operating as an Android banking malware and fraud-as-a-service platform that lets multiple criminal actors create branded malicious apps and run large-scale device-takeover campaigns. Analysis of leaked source packages and exposed infrastructure linked the operation to roughly 1,400 live servers, including command-and-control nodes, an automated APK-building ecosystem, and backend components used to manage victim infections and operator access.
The platform is being spread through fake apps, cloned download pages, and social-engineering lures, including WhatsApp messages and phone calls in Brazil that pressure victims to sideload APKs and grant dangerous permissions. Investigators tied the activity to infrastructure using /yaarsa/ PHP backend paths, HTTP and WebSocket endpoints, a control panel on port 3000 identified by the string "painel de controle elite", and payloads including lnat-tv-pro.apk, BTMob.exe, SolrStarter.exe, and SolrWorker.exe, while also linking the operation to the earlier CraxsRAT and SpySolr malware families.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
A forum-style post advertised a BTMOB 3.6.3 package that allegedly included complete source code, compiled software, reseller panel server code, setup tutorials, and a dropper APK builder source. The listing promoted private branding, deployment of a private reseller panel, and resale of BTMOB license IDs to clients for recurring monthly revenue.
Flare researchers reported that BTMOB activity, first seen in mid-2025, expanded from a centralized malware-as-a-service operation into a broader ecosystem of resellers, source-code sellers, independent operators, and possible impersonators. The report says internal Telegram disputes and a source-code sale to a Brazil-based operator contributed to independent forks, while official and unofficial channels later advertised BTMOB variants including V4.1 in February 2026 and V4.5 in April 2026.
Researchers documented BTMob-related infrastructure and lures including server.yaarsa.com, btmobrat.net, playstoreapps.pro, playstoreap.lovable.app, rastrear-encomendas2.pages.dev, and meusdownloads.site. They also identified lnat-tv-pro.apk as a BTMob v2.5 sample, BTMob.exe as the operator panel, and SolrStarter.exe and SolrWorker.exe as APK-builder components.
The report identified HTTP POST traffic to /yaarsa/private/yarsap_*.php, backend paths including account-creation and login endpoints, and a WebSocket C2 pattern at ws://<host>:8080/con. Associated traffic included fields such as idf, sidf, cip, and itype:"Slr_client", while direct HTTP access to port 8080 returned 426 Upgrade Required.
Researchers confirmed multiple systems as full BTMob C2 servers, including one host exposing web, database, remote desktop, and WebSocket services. Confirmed infrastructure included ports 80, 3000, 3306, 8080, and 3389 and the IP address 77.111.101.24.
Using the Shodan query http.html_hash:-983012381 port:3000, researchers found 1,402 hosts serving BTMob's distinctive fake 403 page. They also used the fingerprint string "painel de controle elite" to locate associated bypass-panel instances.
Researchers at QuimeraX analyzed leaked source packages and exposed servers, identifying BTMob as an Android banking-malware fraud-as-a-service platform with broad live infrastructure and ties to earlier CraxsRAT and SpySolr families.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
codeby.net
Open sourcecysecurity.news
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **BTMOB**, an Android remote access trojan derived from **SpySolr**, is being used to compromise mobile devices through phishing websites and fake app stores. The malware goes beyond typical banking-trojan behavior by abusing **Android Accessibility Services** to gain elevated access and deliver broad remote-control capabilities on infected phones, enabling attackers to burrow deeply into devices and expand post-compromise actions. The operation is being marketed as a **malware-as-a-service** offering that includes an **APK builder**, allowing affiliates to quickly generate localized malicious apps and phishing lures without coding skills. Observed campaigns targeted users in **Brazil** and **Argentina**, including impersonation of Argentina’s tax and customs authorities, and researchers warned that the service’s availability and possible leakage into secondary criminal markets could drive wider adoption. ESET said it detects the toolkit and related payloads under **`MSIL/BtmobRat`**, **`Android/Spy.Agent`**, and **`TrojanDropper`** signatures.
Jun 29, 2026
Multiple Android malware operations have been documented using remote access trojans to seize control of victims’ phones, steal sensitive data, and support financial fraud. Reporting on **CraxsRAT** describes a malware family built to give operators broad device access, while separate research identified **Klopatra**, an Android RAT disguised as the IPTV and VPN app **“Modpro IP TV + VPN,”** infecting more than 3,000 devices in Europe and enabling hidden remote control through a black-screen VNC feature. Klopatra also supports banking overlay attacks, gesture simulation, clipboard theft, keystroke capture, and screen monitoring, allowing attackers to conduct credential theft and fraudulent transactions while the device appears inactive. A third investigation found attackers targeting high-value individuals in South Asia with Android malware built on **SpyNote**, delivered through WhatsApp under multiple app names and tied to shared command-and-control infrastructure. That malware was designed to hide itself after installation and collect location data, contacts, SMS messages, call records, device information, files, screenshots, and keystrokes, particularly when accessibility permissions were granted. Across the reported cases, the malware showed strong evasion and persistence features, including obfuscation, anti-debugging, emulator detection, and attempts to disable security tools, underscoring how modern Android RATs are being adapted for espionage, credential theft, and banking abuse.
Jun 29, 2026
Group-IB reported that **CraxsRAT** is being used as a central malware platform in fake Android app campaigns tied to banking fraud. The malware is distributed through trojanized applications that impersonate legitimate services, allowing attackers to infect devices and gain extensive remote access. Once installed, CraxsRAT can support surveillance, credential theft, and device manipulation, giving operators the ability to harvest sensitive information from victims’ phones. The activity highlights how mobile malware operators are combining social engineering with remote-access tooling to target financial accounts at scale. By embedding CraxsRAT in fraudulent apps, threat actors can bypass user trust, monitor victim activity, and facilitate unauthorized banking transactions, making the malware a key enabler of broader fake-app scam operations against Android users.
Jul 12, 2026