BTMOB: A stealthy RAT burrowing deep into Android devices
BTMOB is a stealthy Android remote access trojan (RAT) that’s rapidly evolving and spreading through phishing campaigns and a ‘malware-as-a-service’ model. It allows attackers to steal data, take control of devices, and impersonate legitimate services, with a growing market for tool customization and resale. Defenders need to be vigilant due to the tool’s rapid mutation and the potential for it to be used in sophisticated fraud operations.
BTMOB, an Android remote access trojan (RAT), has emerged as a significant threat, particularly due to its adaptability and widespread distribution. Initially described in February 2025, BTMOB has evolved from the SpySolr malware and is now a product of the ‘malware-as-a-service’ (MaaS) economy. Unlike traditional banking trojans focused on financial data, BTMOB offers a broader range of capabilities, including data exfiltration, screenshot capture, device control, and impersonation of legitimate online services. The tool is sold through a promotional page on the open web and actively promoted on social media platforms like X and Instagram, with operators offering customized phishing lures tailored to specific regions – for example, campaigns mimicking Argentina’s tax and customs authorities.
BTMOB’s spread relies heavily on social engineering, with attackers directing victims to fake app stores mimicking Google Play. The tool is marketed as a software product, and a Telegram operator facilitates sales. Despite initial restrictions on access, the MaaS model makes it accessible to a wider range of attackers, including less sophisticated criminals. A dark web forum offered BTMOB-related files for free download in January 2026, although the forum later went offline. The tool’s rapid mutation and potential for resale and sharing within closed groups highlight the challenges for defenders.
ESET detects the primary tool as MSIL/BtmobRat, while related Android variants trigger detections such as Android/Spy.Agent.EED, Android/Spy.Agent.EIJ and Android/Spy.Agent.EIK. Cyble’s report from February 2025 noted the appearance of roughly 15 samples of BTMOB v2.5 within a two-week period. To mitigate the risk, organizations should mandate that users download software exclusively from official app stores and treat links with suspicion. Mobile security solutions are crucial, and corporate security teams should emphasize the potential impact of a single rogue download on an organization’s data security.