An Android remote access trojan (RAT) that lets buyers build their own custom payloads without writing a line of code has been observed spreading through phishing campaigns across Brazil and beyond.
According to new analysis from ESET, the malware, known as BTMOB, pairs phishing-based delivery with a packaged app-building tool and full device takeover.
First documented in February 2025, BTMOB evolved from the earlier SpySolr family and extends beyond a typical banking trojan. Rather than only chasing financial credentials, it can exfiltrate data, capture screenshots, record on-device activity and hand operators remote control of the phone.
Sold as a Product, Built Without Code
What sets BTMOB apart, however, is its commercial packaging. The RAT ships with an APK builder interface that lets buyers quickly generate new payloads and retool phishing lures for specific countries, with no coding required.
Distribution follows a familiar social-engineering pattern. Operators steer victims to phishing sites posing as streaming services, crypto-mining platforms or other recognizable brands, then funnel them toward fake app stores that prompt installation of a malicious APK.
Once on the device, BTMOB abuses Android's Accessibility Services to escalate its own permissions and grant itself deeper system access without further user interaction.
Researchers have already seen the kit adapted to impersonate local institutions, including campaigns spoofing Argentina's tax and customs authorities.
Read more on Android MaaS threats: New Android Albiriox Malware Gains Traction in Dark Web Markets
Cheap Licenses, Fast Mutation
BTMOB is sold through a malware-as-a-service (MaaS) model, marketed on a surface-web promotional page that channels buyers to a Telegram operator, alongside seller accounts on X and Instagram.
ESET said a reported $5,000 lifetime license plus a monthly support fee is modestly set against the proceeds of a successful fraud operation, and the service model lowers the bar for less skilled criminals.
That economic logic also makes containment hard. In January 2026, a dark web forum briefly advertised BTMOB files for free before going offline, a reminder that commercial malware rarely stays locked to paying customers once resale and sharing take hold.
Because new variants can be spun up so quickly, ESET warned defenders to expect rapid payload turnover rather than a fixed set of samples.
The company advised users to install apps only from official stores, treat unsolicited links with suspicion and run mobile security software with the same rigor applied to other devices.
"Corporate security teams must make it clear to employees that a single rogue download could expose the company's crown jewels," ESET concluded.