BTMOB Platform Turns Android Banking Trojan into Customizable Fraud Campaign Constructor
Researchers from QuimeraX have disclosed BTMOB, a platform that has grown from a banking trojan into a complete constructor for fraudulent Android campaigns. Home users of Android devices are the primary targets of the operation.
Clients do not need application-development skills. It is sufficient to choose an application name, icon, command-and-control server, requested permissions, and social-engineering lure; the system then assembles a ready-to-use APK. The delivered package contains an Android payload, a dropper, a VB.NET control panel, a PHP and MySQL server component, and application-building utilities.
This architecture enables rapid production of localized copies of streaming services, banking protection modules, parcel trackers, and social-network applications. One version, BTMOB 2.5, was distributed through a phishing site imitating the Turkish service iNat TV. In Brazil, attackers created counterfeit Google Play pages impersonating Nubank, TikTok, and the government service Gov.BR. APK files were also spread via WhatsApp and SMS messages presented as security updates.
After installation the trojan requests accessibility permissions. Once granted, the operator obtains near-complete control over the device: the ability to view the screen, press buttons, enter text, record audio, take photographs, intercept keystrokes, and exfiltrate files. Over banking applications BTMOB overlays phishing windows to harvest credentials.
Management occurs through WebSocket connections in near real time, allowing an attacker to conduct operations directly on the victim’s smartphone while leveraging the device’s trusted status and active session. Analysts associate BTMOB with the SpySolr family and the earlier commercial RATs CypherRAT and CraxsRAT, which were sold as a service and reportedly acquired by more than 100 threat actors, providing a ready customer base for the new criminal product.
Related articles
Octagon Malware-as-a-Service Platform Targets Android Banking Apps and Crypto Wallets for $1400 Monthly Subscription
Researchers at iVerify have uncovered the previously unknown Octagon platform, a malware-as-a-service offering sold by a Russian-speaking actor under the handle AndroidKitKat. The service first appeared on underground forums on June 1, 2026, with version 1.2 released by June 29, providing a ready-made control panel for account takeovers across banks, crypto exchanges, messengers, and wallets. Infection starts with a disguised APK that requests Accessibility Services permissions, after which the trojan can read UI elements, simulate taps, launch apps, and overlay phishing screens on services such as Trust Wallet, Binance, and MEXC. The malware also intercepts SMS one-time codes, spoofs the system lock screen to steal PINs or patterns, and supports VNC-style remote control while operating on the victim’s own device to evade anti-fraud systems. Three related builds—Octagon, Lifted Dreams, and BahrDate—were identified, with one variant displaying a visual novel to distract users while the spyware runs in the background. The campaign underscores the growing threat of sophisticated Android remote-access trojans sold on a subscription basis.
Dysphoria Botnet Compromises Nearly 300,000 Devices for DDoS Attacks and Residential Proxy Services
The Dysphoria botnet has infected approximately 296,000 devices, including routers, IP cameras, gateways, and embedded Linux systems. Researchers first observed the threat in the first quarter of 2026, noting rapid evolution from the jackskid and fbot families. The infrastructure is primarily used for DDoS attacks but has expanded to offer residential proxy capabilities. Infection occurs through brute-force attacks on Telnet and SSH services with weak credentials, as well as known remote code execution vulnerabilities in IoT equipment. A key technical advancement involves the use of Ethereum and Solana blockchain domains for command-and-control infrastructure, making takedowns significantly harder. Compromised devices can also function as relays by leveraging UPnP to expose ports and hide criminal traffic origins. Operators advertise attack capacity of up to 4 Tbps and sell DDoS services in structured commercial packages targeting internet services and gaming platforms worldwide.
TRON, Aptos and BSC in One Infection Chain: JavaScript Loader Linked to ChainVeil Campaign
Researchers at Checkmarx examined the ChainVeil campaign that used npm packages to distribute multi-stage JavaScript loaders. A newly discovered sample appeared in a GitHub repository recommended by an AI agent, where the file navigation.js contained an obfuscated loader that matched the campaign's techniques. The loader retrieves encrypted payloads from TRON, falls back to Aptos, and then uses the extracted data as a BSC transaction identifier to fetch the next stage. C2 infrastructure and final RAT functionality aligned exactly with previously published indicators, except for the campaign identifier A9-0554-3 instead of the A6-* markers seen in npm samples. Git history showed the malicious code was inserted via a merge commit on 29 March 2026, months before the first known npm packages appeared in May. The findings indicate that npm was never the only distribution channel for ChainVeil and that the campaign's blockchain-based delivery mechanism has been active since at least early 2025.
Malinsure Cybercrime Group Deploys SafeMostSSH Backdoor via Phishing Lures Mimicking Russian Insurance Updates
Researchers from F6 identified a previously unknown cybercrime cluster named Malinsure that has been active since at least July 2026. The group distributes phishing emails containing PDF lures themed around voluntary medical insurance (DMS) discounts and updates from Russian insurance companies. Victims are tricked into downloading RAR or ZIP archives that abuse legitimate Microsoft binaries such as winword.exe and powerpnt.exe through DLL side-loading to execute the custom SafeMostSSH backdoor. The malware establishes a persistent reverse SSH tunnel to attacker-controlled servers and retrieves fresh C2 addresses from public posts on vc.ru by decoding fake PNG links. Additional delivery vectors include HTML and SHTML files that decode and drop archives containing the same payload components. Targets appear to include insurance, finance, and fuel-energy sector organizations, with infrastructure also referencing gosuslugi.email and minfin.support domains.