LATIN AMERICA — Cybersecurity firm ESET reported in early 2025 that the BTMOB Android remote access trojan is being actively distributed across Latin America through phishing lures and offers extensive surveillance and control capabilities to cybercriminals. The malware, which functions as a malware-as-a-service platform, is openly advertised on the clearweb and sold via private Telegram channels.

BTMOB provides adversaries with tools to steal specific data, intercept financial transactions, capture screenshots, and take remote control of infected devices. According to ESET, “Unlike banking trojans, which ‘only’ aim to steal people’s financial credentials or intercept their financial transactions, BTMOB gives adversaries broader options: exfiltrate a range of sensitive data, capture screenshots and record activity on the device, and ultimately take remote control of it.”

The trojan is primarily distributed through phishing websites that impersonate legitimate services such as streaming platforms and cryptocurrency mining sites. Victims are redirected to portals mimicking the Google Play Store and prompted to download malicious APK files. Once installed, BTMOB abuses Android Accessibility Services to gain elevated permissions without further user interaction.

ESET researchers noted that BTMOB includes a builder interface allowing customers to easily customize payloads without coding skills. Operators can select which permissions the app requests and configure behaviors like hiding the app icon, disabling Google Play, or preventing the device from entering sleep mode. “Once someone purchases the malicious kit, they can adapt its features, including the phishing lures so they impersonate the brand or agency most likely to lure victims in any given country,” ESET notes.

BTMOB is primarily active in Brazil and other Latin American countries, though ESET warns the threat extends beyond the region. The malware is promoted through an open web page linked to a Telegram channel, as well as social media accounts on X and Instagram. Pricing includes a $700 monthly subscription or a $5,000 lifetime license.

ESET is tracking BTMOB’s rapid evolution, with numerous variants emerging in short timeframes, though some infrastructure elements remain consistent. The firm advises Android users to install apps only from the official Google Play Store, enable Play Protect scanning, and revoke unnecessary permissions—particularly Accessibility access—unless explicitly required.