Cybersecurity researchers have uncovered new details about the underground business behind the Android BTMOB Remote Access Trojan (RAT), revealing how cybercriminals are making advanced malware available to almost anyone. Instead of requiring technical skills, the operators sell BTMOB as a complete malware package with easy-to-use tools. This business model allows attackers to launch Android malware campaigns much faster and with very little effort. The findings show how cybercrime is becoming more organized and accessible to a wider range of criminals.
BTMOB was first identified in 2025 and is believed to have evolved from an older Android malware known as SpySolr. Unlike traditional banking trojans that mainly target banking credentials, BTMOB gives attackers full control over infected Android devices. Once installed, it can collect personal information, capture screenshots, monitor user activity, and execute commands remotely. Researchers say this makes the malware far more dangerous because it supports many different types of cybercrime.
One of the most concerning parts of the operation is the way BTMOB is sold. The malware comes with a ready-made APK builder that allows buyers to create fake Android applications without writing any code. Attackers can easily change app names, icons, and phishing pages to match banks, government services, streaming platforms, or other trusted brands. This flexibility helps criminals quickly adapt their attacks to different countries and target specific victims more effectively.
The operators also promote BTMOB through public websites, Telegram channels, and social media platforms to attract new customers. According to researchers, the malware has been offered with a lifetime license costing around $5,000 along with paid technical support. Earlier this year, parts of the malware were also leaked on underground forums, making it even easier for more threat actors to obtain and modify the code for their own campaigns.
Most BTMOB infections begin with phishing messages that convince users to visit fake websites or download applications from fraudulent app stores. These fake pages are designed to closely resemble trusted services, increasing the chances that victims will install the malicious application. Once the app is opened, it requests powerful Android permissions that allow it to gain deeper access to the device and avoid user suspicion.
After receiving these permissions, BTMOB abuses Android Accessibility Services to perform actions without the user’s knowledge. It can read screen content, steal sensitive information, capture credentials, monitor messages, record activity, and remotely control many device functions. Researchers also observed that the malware continuously changes its appearance and infrastructure, making it more difficult for traditional security tools to detect new variants.
Although many of the recent detections have been linked to campaigns targeting users in Brazil and other parts of Latin America, researchers warn that the threat is not limited to one region. Because attackers can easily customize phishing lures for different languages and countries, the malware can quickly be adapted for global campaigns. This flexibility increases the risk for Android users worldwide, especially those who install apps from unofficial sources.
The investigation highlights how malware developers are now running cybercrime like a commercial business by providing tools, updates, and customer support to other criminals. Security experts recommend downloading apps only from trusted stores, avoiding suspicious links, reviewing app permissions carefully, and keeping Android devices updated with the latest security patches. As malware-as-a-service continues to grow, awareness and cautious online behavior remain some of the strongest defenses against threats like BTMOB.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
