Executive Summary
BTMOB RAT has emerged as a professionalized Android Remote Access Trojan, evolving significantly since early 2025 into a complex marketplace. Originally distributed as a centralized Malware-as-a-Service (MaaS), the ecosystem fractured after the official operators sold the source code for up to $20,000, leading to a secondary market of cheaper resellers, modified variants, and independent server operators. The malware targets global users through social engineering and phishing, masquerading as legitimate applications like WhatsApp mods or government tax portals.
Technically, BTMOB is highly sophisticated, weaponizing Android Accessibility Services to automate permissions, bypass security measures, and perform real-time overlay attacks. It specifically targets financial applications such as Alipay and various banking platforms to capture PINs and credentials. The fragmentation of the codebase across different threat actors means the BTMOB name no longer represents a single threat, but rather a family of diverse and evolving mobile threats with global reach, notably active in Morocco and Latin America.