New BTMOB Malware Enables Remote Control of Android Devices

A newly analyzed Android remote access trojan (RAT) dubbed BTMOB is raising alarms among cybersecurity researchers for its sophisticated device takeover capabilities and its rapid expansion beyond its Brazilian origins.

First documented in February 2025, BTMOB has since evolved into a full-fledged malware-as-a-service (MaaS) platform, putting powerful surveillance tools in the hands of even low-skilled threat actors.

BTMOB traces its lineage to the SpySolr malware family and distinguishes itself from typical banking trojans by offering far broader attack capabilities, ESET said.

BTMOB Malware Enables Remote Control

Once deployed, the malware can exfiltrate sensitive data, capture screenshots, record on-screen activity, and ultimately grant adversaries complete remote control of the compromised device.

What makes BTMOB especially dangerous is its built-in APK builder interface. This point-and-click toolset allows operators to generate new malicious payloads and customize phishing lures for specific regions without writing a single line of code, welivesecurity said.

This dramatically lowers the technical barrier for cybercriminals looking to launch targeted campaigns.

The infection chain begins with social engineering. Operators direct victims to phishing websites masquerading as streaming platforms, cryptocurrency mining services, or government portals.

These sites funnel victims to fake app stores mimicking legitimate repositories, where they are prompted to sideload a malicious APK.

Once installed, BTMOB aggressively abuses Android Accessibility Services to escalate privileges and gain persistent access to the system silently all without requiring any additional user interaction.

Researchers Johnk3r and Merlax recently identified active campaigns impersonating Argentina’s tax and customs authorities, illustrating how operators tailor lures to maximize regional credibility.

BTMOB is openly marketed on the surface web, with sales funneled through a Telegram operator and promotional accounts active on X and Instagram.

A reported $5,000 lifetime license plus monthly support fees represents minimal overhead compared to the returns a successful fraud campaign can generate.

The economics grow more concerning when secondary market dynamics are considered. In January 2026, a dark web forum briefly offered BTMOB-related files as a free download before going offline.

While researchers were unable to recover the payloads, the incident underscores a persistent risk: commercial malware rarely stays contained. Tools inevitably migrate through resale, barter, or closed-group sharing, further expanding the threat surface.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Mitigation

Because BTMOB’s APK builder enables rapid payload generation, defenders should anticipate frequent variant turnover rather than a stable, identifiable threat signature.

ESET currently detects the primary tool as MSIL/BtmobRat, with related Android variants flagged as Android/Spy.Agent.EED, Android/Spy.Agent.EIJ, and Android/Spy.Agent.EIK.

Organizations and individuals can reduce exposure by downloading apps exclusively from official stores, as attackers rely on fake repositories to push malicious APKs.

Treat unsolicited links with suspicion across email, SMS, and social media, and deploy mobile security solutions with MDM policies. Employees must also be reminded that a single rogue APK on a work device can compromise the entire organization.

As BTMOB continues to evolve and expand geographically, its combination of no-code payload generation, phishing-led delivery, and full device takeover capability makes it a credible threat to monitor worldwide.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.