New BTMOB Android Malware Enables Full Device Takeover
BTMOB Android RAT enables device takeover via phishing, sold as $5,000 malware-as-a-service kit
Run ESET?
Get an email when a reviewed story names ESET, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
BTMOB is an Android remote access trojan distributed through phishing attacks that combines financial theft, data exfiltration, and full device control. The malware abuses Android Accessibility Services for privilege escalation and is sold as a customizable malware kit with APK builder interface for $5,000 lifetime license. While primarily observed in Latin America, ESET warns it poses a broader global threat due to rapid mutations and widespread promotion across Telegram, X, and Instagram.
The lesson from this incident
Full lessonBTMOB represents a sophisticated Android malware campaign that succeeds through social engineering attacks that trick users into installing malicious applications and granting excessive permissions. The malware's abuse of Android Accessibility Services demonstrates how legitimate system features can be weaponized when users are manipulated into granting broad device access. The commercialization of this malware as a $5,000 toolkit shows how cybercriminal operations have industrialized, making advanced attacks accessible to less technical threat actors. Organizations must recognize that mobile devices are now prime targets for both financial theft and corporate data exfiltration.
What helps against this
How we list vendors
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
- malware — BTMOB
- malware — SpySolr