Inside the Underground Business of BTMOB RAT

What Is BTMOB RAT?

BTMOB RAT is a sophisticated Android Remote Access Trojan sold commercially as a Malware-as-a-Service (MaaS) platform. First formally identified by Cyble Research and Intelligence Labs (CRIL) in January 2025, it is a direct descendant of the CraxRAT lineage — tracing through CraxRAT → SpySolr → BTMOB — and attributed to a threat actor operating under the handle EVLF (@craxso on social media).

Flare researchers analyzed thousands of underground posts tracking how the operation evolved well beyond a single-actor campaign into one of the most fragmented Android malware ecosystems seen in 2026.

By the Numbers

The Fragmented Underground Ecosystem

What separates BTMOB from typical malware is how deliberately the MaaS model was designed for resale. Rather than operating a single controlled campaign, EVLF built BTMOB to be distributed through layers of intermediaries.

Version Evolution

V2.5 (January 2025) — Initial discovery; approximately 15 samples found distributed through phishing sites impersonating iNat TV (a Turkish streaming service) and fake cryptocurrency mining applications.

V3.x — Lower-priced stable versions targeting a broader buyer base. Leaked variants circulated on underground forums including crackcodes.in, with source code also appearing on GitHub topics.

V4 (Late 2025) — The flagship release with shorter subscription windows at lower price points. Marketed with an explicit "Universal Bypass" claim against Avast, ESET, Google Play Protect, Samsung Knox, and OEM security layers from Vivo, Oppo, Huawei, and Xiaomi. Current version is 4.5.5.

December 2025 — Italian security firm D3Lab published analysis of a leaked BTMOB development toolkit containing the full Android payload source, dropper, builder environment, Windows operator panel, C2 backend, and all deployment dependencies.

Mid-2026 — Source code circulates freely on underground forums and Telegram channels at zero cost, dramatically lowering the barrier to entry and enabling a new wave of independent "fork" operators.

The Three-Tier Operator Structure

DEVELOPER (EVLF / @craxso)
    └── MaaS Platform ($700/mo · $1,200 lifetime)
            ├── Resellers (Forum markets · Telegram channels)
            ├── Source-Code Vendors ($7K–$10K per sale)
            └── Fork Operators (Custom builds · Independent infrastructure)
                    └── Victims (Global · Banking · Crypto · Government lures)

The consequence of this structure: takedown of one operator's infrastructure does not affect any other. There is no single choke point to disrupt.

Technical Capabilities

BTMOB goes well beyond a banking trojan. The platform provides near-total device takeover:

Surveillance and Exfiltration

• Live screen sharing and full remote device control
• Keylogging across all apps
• Clipboard monitoring (cryptocurrency address hijacking)
• Camera access — front and rear
• Microphone recording and live call recording
• SMS interception including OTP codes
• GPS/network location exfiltration
• Contact and notification harvesting

Financial Targeting

• HTML overlay injection on banking and payment apps to capture credentials at point-of-entry
• Specialized capture of Alipay and Brazilian PIX payment PINs
• Browser history and stored credential extraction

Persistence and Evasion

• Abuses Android Accessibility Services to silently grant itself permissions
• Registers broadcast receivers for BOOT_COMPLETED, SMS_RECEIVED, and CONNECTIVITY_CHANGE events — relaunching on every trigger (MITRE ATT&CK Mobile T1624.001)
• Actively monitors Android Settings to block any uninstall attempt — removal requires factory reset
• Encrypted WebSocket C2 channel blends with legitimate HTTPS traffic
• V4 explicitly bypasses: Avast, ESET, Google Play Protect, Samsung Knox, Vivo/Oppo/Huawei/Xiaomi OEM security

Infection Chain

Phishing site (fake streaming / crypto / gov't app)
    → Fake "Update Required" screen
    → APK sideload prompt
    → Accessibility permission abuse
    → Silent secondary payload installation
    → Persistent broadcast listener registration

Notable Derivative Activity

Kaspersky's GReAT documented a BeatBanker + BTMOB bundle distributed via a fake Starlink application — one of the first confirmed derivative campaigns combining BTMOB with a separate banking trojan for layered credential theft.

The December 2025 source code leak is expected to produce a significant increase in BTMOB-based campaigns from less technically sophisticated actors through H2 2026, as the no-code builder eliminates the need for any development skill.

Detection and Defense

ESET Detection Signatures

User-Facing Guidance

1. Install apps only from Google Play Store — never sideload APKs from links, "update" screens, or third-party stores
2. Treat unsolicited links (SMS, email, social) with suspicion, especially those directing to app downloads
3. Never grant Accessibility Services to apps from unfamiliar developers
4. Apply Android OS updates promptly — reduce the exploitable attack surface
5. Deploy mobile security software with behavioral detection

Enterprise and MDM Guidance

• Deploy Mobile Threat Defense (MTD) solutions on all devices accessing corporate resources
• Enforce app vetting policies via MDM — restrict unknown source installations
• Treat ESET BTMOB signatures as high-priority alerts requiring immediate investigation
• Combine IOC feeds with anomaly/behavioral detection — signature-only defenses fall behind MaaS IOC turnover rates
• Monitor for anomalous encrypted WebSocket traffic from Android devices
• The leaked source code means attribution alone is no longer a viable defense strategy — dozens of independent operators now exist

Why It Matters

BTMOB represents a maturation of the MaaS model: a single threat actor has effectively created a self-sustaining underground industry. The source code leak transforms BTMOB from a controlled product into open infrastructure — anyone with a target and a browser can launch a campaign.

For mobile security teams, the combination of advanced evasion, broad accessibility abuse, anti-removal mechanisms, and a now-free builder makes BTMOB one of the most operationally significant Android threats of 2026.

Sources

• BleepingComputer — Inside the Underground Business of BTMOB RAT
• Cyble CRIL — BTMOB RAT Newly Discovered Android Malware
• ESET WeLiveSecurity — BTMOB: A stealthy RAT burrowing deep into Android devices
• Zimperium — BTMOB RAT Demonstrates Deep Persistence on Android Devices
• Dark Reading — BTMOB RAT Spreads Across Brazil, LatAm Via MaaS Model

Related Reading

• ZeroDayRAT Mobile Spyware Platform
• Claude AI Artifacts Abused to Distribute macOS Infostealer