Balonx Sistema PhaaS Targets Mexican Banks with AI and Mobile Malware

• •Balonx Sistema targets over 20 Mexican financial institutions with advanced phishing techniques.
• •The operation utilizes AI for vishing calls and Android RAT malware for real-time OTP theft.
• •Affiliates can access the PhaaS platform through a subscription model, enhancing its reach.

The Balonx Sistema phishing-as-a-service (PhaaS) operation is targeting over 20 financial institutions in Mexico, employing advanced techniques such as real-time OTP theft, AI-driven vishing calls, and Android RAT malware. This sophisticated platform operates on a subscription model, allowing affiliates to access its services for a fee, significantly lowering the entry barrier for cybercriminals. Group-IB's analysis reveals that Balonx Sistema features tiered subscriptions, live victim interaction, and an integrated Android RAT, making it a comprehensive cybercriminal enterprise. The operation has been linked to a significant increase in banking malware incidents in Mexico, which ranked second in Latin America in 2025. Operational security failures, including leaked GitHub repositories, have provided researchers with insights into the platform's infrastructure and victim tracking capabilities. The threat landscape for Mexican banking is evolving, necessitating urgent action from financial institutions and cybersecurity professionals.