Mexico’s financial sector is facing a growing phishing threat from Balonx Sistema, a Phishing-as-a-Service (PhaaS) platform targeting more than 20 banks.
Group-IB researchers found that the operation combines real-time phishing, multi-factor authentication (MFA) interception, an Android remote access trojan (RAT), and AI-powered voice scams.
The campaign reportedly harvested credentials and financial information from more than 1,100 victims since at least October 2025.
Balonx is designed as a subscription service, allowing affiliates with limited technical skills to run banking fraud campaigns through a centralized web panel.
The platform appears to be operated from Mexico and was promoted through Facebook groups associated with data trading and telemarketing fraud.
Researchers gained deeper visibility into its operations after exposed GitHub repositories revealed parts of its infrastructure, affiliate management system, domains, and phishing workflows.
Balonx Targets Mexican Banks
Unlike basic phishing kits that only collect usernames and passwords, Balonx uses persistent WebSocket connections to maintain live communication between a victim’s phishing page and an attacker’s control panel.
This allows fraudsters to monitor victim activity and change the phishing page in real time. The operator can push tailored screens requesting login details, card data, ATM PINs, SMS one-time passwords, transaction authorization codes, identity documents, or selfies.
The real-time approach enables attackers to bypass MFA protections. For example, after a victim enters banking credentials, the operator can attempt to log in to the real banking service.
If the bank sends an OTP challenge, the attacker immediately displays a convincing verification screen and asks the victim to submit the same code.
Balonx expands beyond browser-based phishing by distributing a malicious Android application disguised as banking protection software. Researchers linked the application to the commercial Spyroid RAT framework.
The malware is presented through a fake security warning that convinces victims to install an APK.
Once installed, the RAT can give attackers persistent access to the device and enable theft of SMS messages, keystrokes, screen content, files, and banking-app activity. This capability could help criminals capture authentication codes even after a victim leaves the phishing website.
Researchers also identified a separate AI vishing platform called CallFlow. The module automates fraudulent phone calls by combining a large language model, synthetic speech, speech recognition, and a FreePBX-based calling infrastructure.
CallFlow reportedly uses an AI-generated bank representative voice to speak with targets in real time.
Victim responses are transcribed, processed by an LLM, and answered automatically. This removes the need for large human call-center teams and could allow operators to run many scams simultaneously.
Balonx also rotates domains rapidly to survive takedowns. Group-IB identified more than 350 domains associated with the Balonx and “Aclaraciones Bancarias” campaigns.
A centralized backend allows the group to retain affiliate accounts, victim data, and active sessions while moving to new domains.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
