A stealthy RAT burrowing deep into Android devices

BTMOB is an Android remote access trojan that evolved from SpySolr malware and poses significant threats beyond traditional banking trojans. The malware combines phishing-led delivery with an APK builder interface that enables rapid payload generation without coding skills. Distributed through fake app stores impersonating streaming services, cryptocurrency platforms, and government agencies, BTMOB abuses Android Accessibility Services to gain elevated permissions. Marketed as malware-as-a-service with a reported $5,000 lifetime license, it provides adversaries with capabilities to exfiltrate sensitive data, capture screenshots, record device activity, and establish remote control. The tool's customizable phishing lures have been adapted for specific regions, including campaigns impersonating Argentine tax authorities, making it a rapidly evolving threat with global reach.

• Inside a Packed Android RAT LoaderMalware2026-09-08
• Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night DragonMalware2026-07-28
• Adversary Unmasked APT Profile · Star BlizzardThreat Actor2026-10-28
• False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking AppsMalware2026-10-28
• Inside "MR ROBOT" - Anatomy of a Malware-as-a-Service Operation Targeting Indian Bank CustomersMalware2026-10-28