Malware
BTMOB Android RAT: Phishing, Fake App Stores, and Accessibility Exploit
BTMOB is an Android RAT that spreads via phishing sites and counterfeit app stores, then abuses Accessibility Services to gain full device control. The malware is sold with an APK‑builder, enabling rapid, code‑free payloads. Defenders should block malicious domains, disable unknown accessibility services, and enforce app‑store vetting.
What happened
BTMOB, first identified in February 2025, is a remote‑access trojan that evolved from the SpySolr family. It is distributed through phishing URLs that masquerade as streaming services or cryptocurrency platforms, directing users to counterfeit app stores where a malicious APK is installed.
How it spreads
After installation, the malware exploits Android Accessibility Services to elevate its privileges, gaining system‑level access without further user interaction. The attackers also provide an online APK‑builder, allowing anyone to generate new payloads and tailor phishing lures for specific regions without writing code.
Impact
Once compromised, BTMOB can exfiltrate arbitrary data, capture screenshots, record device activity, and ultimately take full remote control of the device. The combination of phishing, fake app stores, and accessibility abuse makes it a potent threat beyond Brazil and Latin America.
What to do
- Block known malicious domains and phishing URLs at the network perimeter.
- Disable Accessibility Services for apps that have not been explicitly approved by your organization.
- Enforce strict app‑store vetting and only allow installations from verified sources.
- Keep the Android OS and security patches up to date to mitigate known exploitation vectors.
- Educate users on the risks of installing apps from unofficial stores and the importance of verifying app authenticity.
Related vulnerabilities
RemControl Android Banking Malware Targets European and Canadian Users via Fake IPTV Ads
RemControl, a new Android malware‑as‑a‑service platform, has been delivering banking trojans through fake TVTap IPTV ad sites. The campaign, active since May, targets users in Italy, France, Spain, Poland, Portugal, Canada and the Middle East. Defenders should block known malicious domains, enforce app‑store vetting, and monitor for phishing overlays on Android devices.
Read briefing
Android RAT Hirudo Replaces Banking Apps with Trojanized Copies
A new Android RAT, Hirudo, drops trojanized copies of banking apps to bypass security controls, targeting eight Indonesian banks and potentially others. Defenders should block suspicious app downloads, monitor for unknown RATs, and enforce app vetting.
Read briefing
Hirudo Android Trojan Replaces Banking Apps with Patched Versions to Evade Security Checks
A new Android banking trojan, Hirudo, replaces legitimate banking apps with custom patched copies that bypass in‑app integrity and signature checks. The malware, delivered via popular dropper apps, steals credentials, takes device control, and captures screens, cameras, and SMS. Defenders should audit banking app integrity, block suspicious in‑app updates, and monitor for unauthorized accessibility services.
Read briefing
Hirudo Android Malware Hijacks Banking Apps to Steal Credentials
Hirudo is an Android malware that replaces legitimate banking apps with malicious copies, disabling security checks to harvest credentials and remotely control devices. It targets banks in Indonesia, China, India, Mexico, Morocco, and Thailand, and is delivered via apps that masquerade as shopping or entertainment services. Defenders should verify app signatures, enforce Play Integrity, restrict Accessibility permissions, and deploy mobile security solutions to detect hooking engines.
Read briefing