DIGITAL LIFE

New remote access trojan threatens Android ecosystem
The European cybersecurity company ESET has issued a global alert about the discovery of a new remote access trojan that compromises the security of Android devices through advanced social engineering tactics. The threat stands out for its ability to collect sensitive data and capture all user activity remotely. Unlike conventional tools focused on stealing banking credentials, this code allows you to take complete remote control of the affected equipment.
What is BTMOB and why is it a concern...BTMOB is classified as a RAT (Remote Access Trojan). Among the features provided by its creators, a tool for creating malicious applications stands out, allowing cybercriminals to launch campaigns more quickly and efficiently.
As already mentioned in other WeLiveSecurity articles, Brazil is known for the high incidence of Trojan detections. However, due to characteristics of the local scenario, these detections tend to be concentrated on banking Trojans.
In general, Trojans are threats that disguise themselves as legitimate files or applications to deceive victims and infect their devices. In the case of banking Trojans, the focus is on stealing financial information. RATs, on the other hand, have a more comprehensive scope, allowing everything from the theft of different types of data to complete monitoring of the infected device.
Among the capabilities of this type of malware are keylogging, periodic screen capture, activity recording, file transfer, and hijacking of active sessions. In the specific case of BTMOB, the possibility of real-time screen transmission was also observed, in addition to direct interaction between cybercriminals and the compromised device.
How BTMOB is distributed...Several social engineering campaigns have been used to distribute BTMOB. Among them, phishing sites that impersonate well-known streaming services stand out, as well as fake cryptocurrency mining platforms.
Since it is a threat focused on Android devices, the campaigns observed in Brazil concentrate their efforts on creating malicious versions of popular applications. These apps are distributed through social engineering, frequently directing victims to fake app stores that mimic the appearance of the Google Play Store.
BTMOB was also identified as being offered as a service on a website hosted on the open web (surface web). The page is simple and directs interested parties, through clickable links, to contact the BTMOB operator via Telegram.
In addition, references to the tool were found on social networks. An account on platform X (formerly Twitter), for example, redirects interested parties to the same contact on Telegram. Other platforms, such as Instagram, also present content related to the dissemination of the malware.
Analyses conducted by two independent researchers, Johnk3r and Merl, also point to the spread of the threat in other countries. In one case identified in Argentina, cybercriminals used the impersonation of a government agency, the Agencia de Recaudación y Control Aduanero, to distribute the malware, increasing the credibility of the campaign and potentially increasing the number of victims.
“BTMOB shows how the smartphone can go from being just a target for fraud to becoming a control point for the attacker. When the user installs a fake application and grants critical permissions, they are potentially exposing not only their data, but all the activity they maintain on the device,” says Ricardo Neves, Communications Manager at ESET Brazil.
The infection process begins with redirecting victims to phishing pages that replicate the visual identity of legitimate services, such as streaming platforms or cryptocurrency mining systems. From these addresses, users access fake app stores designed to mimic official repositories, such as the Google Play Store, where they download malicious installation files in APK format.
Technical analysis conducted by the ESET research team indicates that the first detections of this remote access trojan occurred in Brazilian territory. Additionally, records shared by analyst Germán Fernández Bacian document the group's activity in Argentina, with the direct falsification of the official portal of the government agency ARCA. The potential for geographic expansion of this infrastructure remains high due to the flexibility of the distribution model.
Abuse of Accessibility Services elevates privileges in the system...Once the installation on the target device is complete, this remote access trojan immediately begins attempts to obtain elevated administrative permissions. The critical vector for consolidating the attack lies in the systematic abuse of the Android operating system's Accessibility Services. This legitimate feature, designed to support users with special needs, allows the malicious application to perform automated actions without requiring any additional interaction or consent from the mobile phone user.
The criminal ecosystem associated with this campaign operates under the Malware-as-a-Service (MaaS) model. The creators offer an automation tool that allows the generation of new variants of the APK file without requiring advanced programming knowledge. The marketing of the product includes structured sales channels and dedicated technical support services, factors that significantly accelerate the circulation of this remote access trojan in multiple markets.
FAQ – Frequently Asked Questions:
- What is a remote access trojan and what are the risks on Android?
A remote access trojan is a type of malware that allows cybercriminals to take complete control of a device remotely. On Android, this threat monitors activity and collects sensitive data through abusive administrative privileges.
- How does an Android device get infected by this code?
The infection develops through social engineering schemes where the victim accesses fake links to known services. These portals direct the user to fake app stores, where a malicious APK file is downloaded.
-How does malware bypass system protections?
The fraudulent application requests the activation of Android Accessibility Services. By obtaining this level of authorization, the code gains administrative privileges that enable the autonomous execution of commands and the collection of information without the user's knowledge.
Key points:
-Full remote control: The malicious code surpasses the functions of common banking trojans and allows remote management of the affected smartphone.
-Professional distribution: The threat operates as a commercial service with automatic APK generators and technical support channels for buyers.
-Accessibility abuse: Exploitation of Android Accessibility Services serves to automate actions and bypass system security restrictions.
-Use of fake repositories: Attackers accurately replicate the design of official stores and government portals to deceive victims.
mundophone



