Balonx Sistema: The Face Behind the PhaaS Affecting Mexican Banking

Balonx Sistema is a sophisticated criminal Phishing-as-a-Service platform operated from Mexico, targeting financial institutions via tiered subscription access. It defeats multi-factor authentication by hijacking WebSocket sessions in real time and distributes a Spyroid Android RAT through deceptive security alerts. Since late 2025, it has compromised credentials from over 1,100 victims. The platform's CallFlow module automates voice phishing using AI technologies including GPT-4o-mini, ElevenLabs synthetic voice, and OpenAI Whisper, removing human involvement. It continuously rotates through more than 350 domains to evade detection and uses centralized PostgreSQL infrastructure. The operation is openly promoted on social media and generates significant revenue from criminals subscribing to the service.

The platform compromises credentials of over 1,100 victims, primarily targeting Mexican financial institutions. It bypasses multi-factor authentication protections via WebSocket hijacking and installs a Spyroid Android RAT, enabling persistent access to victims' devices. The AI-driven vishing module automates telephone fraud, increasing the scale and efficiency of attacks without human involvement. Continuous domain rotation and centralized infrastructure enhance the platform's resilience and evasion capabilities. Financial losses are generated through subscription fees paid by criminals using the service, facilitating ongoing fraud campaigns.

No official patch or fix is applicable as this is a criminal phishing platform rather than a software vulnerability. Defenders should focus on detecting and blocking the identified infrastructure indicators such as IP 196.251.84.11 and associated domains (e.g., soporte-aclaracion.xyz, balonx.online, callbalonx.info, panelbalonxfs.xyz, phishing-domain.xyz). Financial institutions should enhance monitoring for WebSocket hijacking attempts and suspicious Android app installations resembling the Spyroid RAT. User awareness campaigns about phishing and AI-generated fraudulent calls may reduce victimization. Collaboration with law enforcement and threat intelligence sharing is recommended to disrupt the platform's operations.