Reported by 2 outlets
Balonx PhaaS Steals Bank OTPs in Real Time While AI Calls and Android RAT Target Victims
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.57 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
update from cyberpress.org
Balonx PhaaS Targets 20+ Mexican Banks With Real-Time MFA Bypass, Android RAT and AI Vishing
cyberpress.org · 55d ago · August 19th, 2026
Mexico’s financial sector is facing a growing phishing threat from Balonx Sistema, a Phishing-as-a-Service (PhaaS) platform targeting more than 20 banks. Group-IB researchers found that the operation combines real-time phishing, multi-factor authentication (MFA) interception, an Android remote access trojan (RAT) , and AI-powered voice scams. The campaign reportedly harvested credentials and financial information from more than 1,100 victims since at least October 2025. Balonx is designed as a subscription service, allowing affiliates with limited technical skills to run banking fraud campaigns through a centralized web panel. The platform appears to be operated from Mexico and was promoted through Facebook groups associated with data trading and telemarketing fraud. Researchers gained deeper visibility into its operations after exposed GitHub repositories revealed parts of its infrastructure, affiliate management system, domains, and phishing workflows. Balonx Targets Mexican Banks Unlike basic phishing kits that only collect usernames and passwords, Balonx uses persistent WebSocket connections to maintain live communication between a victim’s phishing page and an attacker’s control panel. This allows fraudsters to monitor victim activity and change the phishing page in real time. The operator can push tailored screens requesting login details, card data, ATM PINs , SMS one-time passwords, transaction authorization codes, identity documents, or selfies. Landing page of the B
-
update from gbhackers.com
Balonx PhaaS Steals Bank OTPs in Real Time While AI Calls and Android RAT Target Victims
gbhackers.com · 55d ago · August 19th, 2026
Balonx is not a conventional credential-harvesting kit. It operates as a subscription-based criminal service that rents access to affiliates, lowering the barrier for telemarketing fraud groups and inexperienced […] The post Balonx PhaaS Steals Bank OTPs in Real Time While AI Calls and Android RAT Target Victims appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .