Balonx Sistema is a criminal Phishing-as-a-Service platform originating from Mexico that targets financial institutions through tiered subscription models. It leverages real-time WebSocket session hijacking to circumvent multi-factor authentication protections and distributes a Spyroid-based Android Remote Access Trojan (RAT) via deceptive security alerts. The operation has compromised credentials of more than 1,100 victims since late 2025. Additionally, it features CallFlow, an AI-powered vishing system utilizing GPT-4o-mini, ElevenLabs synthetic voice technology, and OpenAI Whisper for automated voice fraud, eliminating the need for human operators. The platform maintains a centralized PostgreSQL backend and rotates through more than 350 domains continuously since 2019 to evade detection. It is openly advertised in Facebook groups and generates significant illicit revenue through subscription fees ranging from 3,000 to 6,000 MXN weekly.

The threat compromises user credentials from over 1,100 victims, primarily targeting Mexican financial institutions. It defeats multi-factor authentication via WebSocket hijacking and delivers a Spyroid Android RAT, enabling attackers to gain persistent access to victims' devices. The AI-driven vishing module automates telephone fraud, increasing the scale and efficiency of attacks without human involvement. The platform's domain rotation and centralized infrastructure enhance its resilience and evasion capabilities. Financial losses are generated through subscription fees paid by criminals using the service, facilitating ongoing fraud campaigns.

No official patch or fix is applicable as this is a criminal phishing platform rather than a software vulnerability. Defenders should focus on detecting and blocking the identified infrastructure indicators such as IP 196.251.84.11 and associated domains (e.g., soporte-aclaracion.xyz, balonx.online, callbalonx.info, panelbalonxfs.xyz, phishing-domain.xyz). Financial institutions should enhance monitoring for WebSocket hijacking attempts and suspicious Android app installations resembling Spyroid RAT. Awareness campaigns to educate users about phishing and fraudulent calls leveraging AI-generated voices may reduce victimization. Collaboration with law enforcement and threat intelligence sharing is recommended to disrupt the platform's operations.