Balonx PhaaS Steals Bank OTPs in Real Time While AI Calls and Android RAT Target Victims

Gbhackers •Mayura Kathir • August 19, 2026

Mexico’s banking sector is facing a more industrialized fraud threat as the Balonx Sistema phishing-as-a-service (PhaaS) operation combines real-time OTP theft, Android malware, and AI-generated vishing calls. Balonx is not a conventional credential-harvesting kit. It operates as a subscription-based criminal service that rents access to affiliates, lowering the barrier for telemarketing fraud groups and inexperienced […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Balonx Sistema PhaaS Targets Mexican Banks with AI and Mobile Malware The Balonx Sistema phishing-as-a-service (PhaaS) operation is targeting over 20 financial institutions in Mexico, employing advanced techniques such as real-time OTP theft, AI-driven vishing calls, and Android RAT malware. This sophisticated platform operates on a subscription model, allowing affiliates to access its services for a fee, significantly lowering the entry barrier for cybercriminals. Group-IB's analysis reveals that Balonx Sistema features tiered subscriptions, live victim interaction, and an integrated Android RAT, making it a comprehensive cybercriminal enterprise. The operation has been linked to a significant increase in banking malware incidents in Mexico, which ranked second in Latin America in 2025. Operational security failures, including leaked GitHub repositories, have provided researchers with insights into the platform's infrastructure and victim tracking capabilities. The threat landscape for Mexican banking is evolving, necessitating urgent action from financial institutions and cybersecurity professionals. 3 sources 67

Extracted Entities

Balonx PhaaS Steals Bank OTPs in Real Time While AI Calls and Android RAT Target Victims

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)

Countries (1)

MITRE ATT&CK (1)

Platforms (1)