BTMob Uses Custom Phishing Apps to Turn Android Users Into Remote

Gbhackers •Mayura Kathir • August 18, 2026

BTMOB has evolved beyond a conventional Android banking trojan into a turnkey fraud platform that lets criminals build branded phishing apps, remotely operate infected phones, and automate theft. Its emergence illustrates how leaked malware source code and low-code tooling are turning mobile fraud into a scalable franchise. The malicious lnat-tv-pro.apk sample connected to server[.]yaarsa[.]com/con over […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Surge in Android Banking Trojans: Four Campaigns Identified Zimperium's zLabs has reported a significant increase in Android Banking Trojan activity, identifying four distinct campaigns: RecruitRat, SaferRat, Astrinox, and Massiv. These campaigns utilize advanced Command-and-Control (C2) frameworks to steal credentials, execute unauthorized financial transactions, and exfiltrate data from over 800 applications in banking, cryptocurrency, and social media sectors. The trojans employ sophisticated anti-analysis techniques and APK tampering, achieving near-zero detection rates against traditional security measures. Attackers exploit human psychology through deceptive tactics, such as fake system updates and enticing offers, to gain initial access. The malware's distribution methods vary, with SaferRat using phishing websites for fake streaming services and RecruitRat masquerading as legitimate job opportunities. The threat landscape for mobile banking has evolved, necessitating heightened vigilance from users and security professionals alike. 113 sources 70

Extracted Entities

Domains (1)

server.yaarsa.com