Malware · 125 giorni fa
BTMOB è passato da un Android RAT riutilizzabile a un servizio che può produrre in massa payload di phishing localizzati. La rottura è la scala: gli acquirenti non devono codificare o localizzare da soli il lure, quindi la stessa campagna può essere riconfezionata per diversi brand e paesi molto più rapidamente di quanto l’invecchiamento delle difese statiche le renda obsolete.
6 fonti che coprono questa storia
BTMOB Android malware service generates custom phishing payloads
An Android remote access trojan named BTMOB is offered to cybercriminals with a builder interface for generating malware payloads tailored to phishing lures.
BTMOB RAT Spreads Across Brazil, LatAm Via MaaS Model
An advanced remote access Trojan is spreading; it's delivered via an operator licensing model and features a no-code malware-development interface.
New BTMOB Android Malware Enables Full Device Takeover
Delivered via phishing lures, the malware combines financial theft with data exfiltration and remote access.
Grandoreiro Malware and BTMOB RAT Campaigns Target Windows and Android Users
Grandoreiro and BTMOB campaigns targeted Europe and Latin America in 2026, increasing banking malware risks.
BTMOB Android RAT Spreads Through No-Code Builder Tooling
BTMOB Android RAT sold as a service with a no-code builder for fast, regional phishing lures
BTMOB: A stealthy RAT burrowing deep into Android devices
The BTMOB malware pairs remote access capabilities with ready-made campaign tools, lowering the barrier for full device compromise.
Part of the PlainSec briefing for 2026-05-27