# BTMOB Android RAT — SpySolr Evolution Sold as MaaS via Telegram with APK Builder and Accessibility Services Abuse

> BTMOB is an Android remote access trojan that evolved from the SpySolr malware family first publicly documented by Cyble in February 2025. It is sold as malware-as-a-service ($5,000 lifetime license plus a monthly support fee) through a Telegram-fronted operator with X and Instagram promotion, and ships with an APK builder interface that lets non-developer affiliates generate region-tailored payloads. Once installed via fake app stores fronted by streaming-service or crypto-mining lures, BTMOB abuses Android Accessibility Services to elevate permissions, capture screenshots, record device activity, exfiltrate sensitive data, and grant operators full remote control of the device. Active campaigns have been observed in Brazil and Argentina impersonating tax and customs authorities.

- **Published:** 2026-05-27T00:00:00Z
- **Last reviewed:** 2026-08-04T19:59:59Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0600
- **ID:** TL-2026-0600
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** BTMOB MaaS operator
- **Detections:** 9 · **IOCs:** 49 (full data via the Threadlinqs MCP server — Purple tier)

## Description

BTMOB is a commodity Android remote access trojan (RAT) and information-stealer documented by ESET researcher Daniel Cunha Barbosa on 26 May 2026. ESET attributes BTMOB as a direct evolution of the SpySolr Android malware first profiled in a Cyble report in February 2025, where roughly 15 v2.5 samples were observed within approximately two weeks of late January 2025. The family is operated under a malware-as-a-service (MaaS) model: a public-facing promotional page advertises the tool on the open web and funnels prospective buyers to a Telegram operator, while a sales pipeline extending across X (Twitter) and Instagram peddles the kit to less sophisticated adversaries. The reported pricing is a $5,000 lifetime license plus a recurring monthly support fee — a price point that ESET assesses as low relative to the fraud returns a successful operation can generate and that materially lowers the barrier to entry.

The BTMOB kit ships with an APK builder interface that allows non-developer affiliates to repackage the implant with customised phishing lures, branding, and language so the dropper impersonates the brand or government agency most likely to lure victims in any given country. Researchers Johnk3r and Merl (cited by ESET) recently observed campaigns spreading BTMOB while impersonating Argentina's national tax and customs authorities, and additional activity has been seen in Brazil. Because variants can be regenerated quickly by affiliates, defenders should expect rapid payload turnover rather than a stable IOC set.

Infection begins with social engineering. Operators direct targets to phishing websites that pose as legitimate streaming services, cryptocurrency-mining platforms, or other familiar online services. Victims are then funnelled to fake app stores that imitate the visual identity of legitimate repositories such as Google Play and instructed to install a malicious APK side-load. Once the APK is installed, BTMOB requests broad permissions and — critically — abuses the Android Accessibility Services framework. By coercing the victim into granting the Accessibility permission, the implant gains the ability to read screen content, simulate user input, auto-approve subsequent permission prompts, and overlay deceptive screens, effectively granting itself further system access without additional user interaction.

Post-installation, BTMOB's capabilities include screen capture and screen recording, audio capture, harvesting of notifications and clipboard contents, keystroke and on-screen input capture via Accessibility, location tracking, exfiltration of credentials and stored application data, and full remote control of the device — allowing the operator to interact with banking, email, and messaging applications in real time. ESET products detect the Windows-side builder/operator tooling as MSIL/BtmobRat, while the Android payloads trigger detections such as Android/Spy.Agent.EED, Android/Spy.Agent.EIJ, Android/Spy.Agent.EIK, Android/Spy.Spysolr.A, Android/TrojanDropper.Agent.NES, Android/TrojanDropper.Agent.NDK, Android/TrojanDropper.Agent.NBO, Android/Spy.Agent.EUG, Android/Spy.Agent.EWN, Android/Spy.Agent.FFE, Android/Spy.Agent.FFL, Android/Spy.Agent.FFM, Android/Spy.Agent.FEE, Android/Spy.Agent.ELM, and Android/Agent.FQK.

A secondary-market risk amplifies the threat surface. In January 2026, a dark web forum claimed to offer BTMOB-related files for free download; the forum has since gone offline and ESET could not recover the payload(s), but the episode is consistent with the recurring pattern of commercial Android malware leaking out of paid distribution and into secondary resale, barter, and sharing inside closed groups. Defenders should treat the IOC list as a triage starting point rather than a definitive boundary — infrastructure churn is expected, but specific patterns (the arbsniper.com C2 domain, the 191.96.78.0/24 and 191.96.79.0/24 hosting ranges, and SHA256 hashes of leaked builder outputs) often recur across affiliates.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1585 Establish Accounts
- T1660 Phishing
- T1456 Drive-By Compromise
- T1474 Supply Chain Compromise
- T1575 Native API
- T1541 Foreground Persistence
- T1624 Event Triggered Execution
- T1626 Abuse Elevation Control Mechanism
- T1655 Masquerading
- T1628 Hide Artifacts
- T1632 Subvert Trust Controls
- T1516 Input Injection
- T1417 Input Capture
- T1517 Access Notifications
- T1414 Clipboard Data
- T1418 Software Discovery
- T1426 System Information Discovery
- T1422 System Network Configuration Discovery
- T1513 Screen Capture
- T1512 Video Capture
- T1429 Audio Capture
- T1430 Location Tracking
- T1636 Protected User Data
- T1409 Stored Application Data
- T1532 Archive Collected Data
- T1437 Application Layer Protocol
- T1521 Encrypted Channel
- T1481 Web Service
- T1646 Exfiltration Over C2 Channel
- T1582 SMS Control
- T1641 Data Manipulation

## Sources

- [BTMOB: A stealthy RAT burrowing deep into Android devices](https://www.welivesecurity.com/en/malware/btmob-stealthy-rat-burrowing-deep-android-devices/)
- [SpySolr: Cyble analysis of v2.5 Android RAT samples (Feb 2025)](https://cyble.com/blog/)
- [MITRE ATT&CK Mobile: T1660 Phishing](https://attack.mitre.org/techniques/T1660/)
- [MITRE ATT&CK Mobile: T1626 Abuse Elevation Control Mechanism](https://attack.mitre.org/techniques/T1626/)
- [MITRE ATT&CK Mobile: T1513 Screen Capture](https://attack.mitre.org/techniques/T1513/)
- [MITRE ATT&CK Mobile: T1655 Masquerading](https://attack.mitre.org/techniques/T1655/)
- [Android Developers: Accessibility Service security guidance](https://developer.android.com/guide/topics/ui/accessibility/service)
- [Germán Fernández Bacian — BTMOB Argentina tax impersonation campaign](https://x.com/1ZRR4H)
- [@Merlax_ — Fake app store imagery linked to BTMOB](https://x.com/Merlax_)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0600