Balonx Sistema PhaaS Campaign — AI Voice Calls and Fake Banking Pages Targeting Mexican Financial Institutions

Key facts for Balonx Sistema AI vishing campaign

Detection coverage for Balonx Sistema AI vishing campaign

As of 2026-08-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2072 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Balonx WebSocket AitM Phishing Page — Credential Harvesting via /ws Relay

Detects WebSocket connections to the /ws endpoint on Balonx phishing domains, indicating real-time adversary-in-the-middle (AitM) session relay. The platform uses a persistent bi-directional WebSocket link to dynamically push 14 fraudulent screen types (LOGIN, CODIGO, NIP, TARJETA, SMS_COMPRA, etc.) to steal credentials, OTPs, ATM PINs, card details, and purchase authorization codes from victims of Mexican financial institutions.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1557, T1111, T1539, T1583.001
• Data sources: web_proxy, network_firewall, ssl_decryption
• Severity: high
• Confidence: high

Splunk SPL

index=proxy sourcetype=bluecoat:proxysg uri_path="/ws"
| eval domain_lower=lower(uri_domain)
| eval is_suspicious=case(
    like(domain_lower,"%aclaraciones%"),"phishing_aclaraciones",
    like(domain_lower,"%soporte-aclaracion%"),"phishing_support",
    like(domain_lower,"%balonx%"),"balonx_infrastructure",
    1=1,"unknown")
| search is_suspicious IN ("phishing_aclaraciones","phishing_support","balonx_infrastructure")
| table _time, src_ip, uri_domain, uri_path, http_method, user_agent, referer_domain, is_suspicious
| sort -_time
| eval threat_phase=case(
    is_suspicious="balonx_infrastructure","confirmed_balonx",
    is_suspicious="phishing_aclaraciones","aclaraciones_bancarias_campaign",
    is_suspicious="phishing_support","balonx_support_infra",
    1=1="monitor")

Microsoft KQL

CommonSecurityLog
| where DeviceVendor == "Blue Coat"
| where RequestURL has "/ws"
| extend Domain = extract(@"https?://([^/]+)", 1, RequestURL)
| extend Path = extract(@"https?://[^/]+(/[^\s]*)", 1, RequestURL)
| where Domain has_any ("aclaraciones", "soporte-aclaracion", "balonx", "callbalonx", "panelbalonxfs")
| extend IsSuspicious = iif(
    Domain has_any ("balonx", "callbalonx", "panelbalonxfs"),
    "confirmed_balonx",
    "monitor_aclaraciones"
)
| project TimeGenerated, SourceIP, Domain, Path, RequestMethod, DeviceAction, IsSuspicious
| sort by TimeGenerated desc

Sigma

title: Balonx WebSocket AitM Phishing /ws Endpoint Detection
id: d5b8f4c2-6e9a-4b3d-0f7c-2a4e8b6d9f1c
status: experimental
description: Detects WebSocket connections to /ws endpoints on domains matching the Balonx Aclaraciones Bancarias phishing infrastructure. The platform uses a persistent bi-directional WebSocket relay to enable real-time adversary-in-the-middle (AitM) credential harvesting, OTP interception, and dynamic screen manipulation across 14 distinct screen types targeting Mexican financial institution customers.
references:
  - https://www.group-ib.com/blog/balonx-sistema-mexico-phaas/
  - https://cybersecuritynews.com/hackers-use-ai-voice-calls/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/08/19
tags:
  - attack.collection
  - attack.t1557
  - attack.credential_access
  - attack.t1111
  - attack.t1539
  - attack.resource_development
  - attack.t1583.001
logsource:
  category: proxy
  product: web_proxy
detection:
  selection:
    cs_uri_path|contains:
      - /ws
    cs_uri_domain|contains:
      - aclaraciones
      - soporte-aclaracion
      - balonx
      - callbalonx
      - panelbalonxfs
  condition: selection
falsepositives:
  - Legitimate WebSocket connections used by web applications (chat, collaboration tools, real-time dashboards)
  - WebSocket health checks or monitoring probes
level: high
fields:
  - cs_uri_domain
  - c_ip
  - cs_user_agent
  - cs_referrer

Known false positives:

• Legitimate WebSocket connections used by web applications (chat, real-time collaboration, monitoring dashboards)
• WebSocket health checks or uptime monitoring probes
• Legitimate banking applications using WebSocket for real-time features

Tuning notes: For higher fidelity, correlate /ws connections with phishing page referrers (suspicious banking login pages) and the presence of both credential input fields and OTP submission forms. Tune domain list as new Balonx domains are identified — the campaign rotates domains frequently. Consider adding network traffic analysis for WebSocket upgrade (101 Switching Protocols) responses with atypical origin domains.

• 🔒 Balonx PhaaS Spearphishing Link Delivery via Phishing Domains · unlock with TL Creds
• 🔒 Balonx AitM WebSocket Relay — Multi-Factor Authentication Interception · unlock with TL Creds
• 🔒 Spyroid RAT — Android Package [indicator] Installation and Execution · unlock with TL Creds
• 🔒 Balonx PhaaS Phishing Kit — Fake Banking Page and API Infrastructure · unlock with TL Creds
• 🔒 Balonx AitM Session Cookie Theft and WebSocket Relay — Post-Authentication Hijacking · unlock with TL Creds
• 🔒 Balonx PhaaS Infrastructure — Domain Rotation and Subdomain Pattern Detection · unlock with TL Creds
• 🔒 Balonx CallFlow AI Vishing SIP Outbound Call Detection · unlock with TL Creds
• 🔒 Spyroid Android RAT ([indicator]) C2 Communication Detection · unlock with TL Creds

Indicators of compromise for Balonx Sistema AI vishing campaign

As of 2026-08-20, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-2072.

Sample indicators (3 of 20)

• IP address: 196.251.84[.]11
• Domain: aclaraciones-digital[.]online
• IP address: 85.31.235[.]109

Defanged, TLP:CLEAR. Full set of 20 indicators: unlock with TL Creds.

How Balonx Sistema AI vishing campaign works

Credentials and data have been collected from over 1,100 victims since at least October 2025.

Balonx Sistema is a highly structured, subscription-based Phishing-as-a-Service (PhaaS) platform developed by a Mexico-based cybercriminal operative and exposed by Group-IB following a critical operational security failure — leaked GitHub repositories that revealed hardcoded credentials, infrastructure details, and the full affiliate network. The platform operates as a criminal SaaS model, renting access to sophisticated phishing infrastructure on a weekly subscription basis (Individual: 3,000 MXN/week, ~$172 USD; Office: 6,000 MXN/week, ~$345 USD), with automated payment processing via the Bitso API (Mexican cryptocurrency exchange) and discount code promotional flexibility.

The platform combines three core technical capabilities into a single attack chain. First, the CallFlow AI vishing module uses GPT-4o-mini for conversational dialog generation, ElevenLabs for high-quality synthetic speech (voice profile 'Carolina'), and OpenAI Whisper for real-time speech-to-text transcription, all running on a FreePBX/Asterisk telephony backend (SIP server 85.31.235.109:5160/TCP). CallFlow completely automates outbound vishing calls, impersonating bank representatives without requiring human operators. Managers can covertly monitor active calls via Asterisk ChanSpy. Second, the WebSocket-based adversary-in-the-middle (AitM) phishing platform uses a persistent /ws endpoint on all active phishing domains to maintain a real-time bi-directional link between the victim's browser and the operator's control panel. The operator can dynamically push 14 distinct screen types (FOLIO, VALIDANDO, LOGIN, CODIGO for OTPs, NIP for ATM PINs, TARJETA for card details, SMS_COMPRA for purchase authorization, CANCELACION_RETIRO for cardless withdrawal codes, ESCANEAR_QR for physical card QR scans, PROTECCION_BANCARIA for APK delivery, PROTECCION_SALDO for balance capture, VERIFICACION_ID for ID/selfie theft via camera, MENSAJE for custom messages, and CANCELACION for completion). Affiliates can also pre-configure automated screen sequences via 'Mi Flujo Personal' (Personal Flows) that auto-execute, enabling less skilled operators to run sophisticated sessions. Third, an Android RAT built on the commercial Spyroid framework (package name: 'sacred.explosion', main class: 'bxelllolzxqfmaszk1049') is distributed through the PROTECCION_BANCARIA screen as a fake bank security alert. The RAT establishes a persistent TCP connection to C2 at 196.251.84.11:7771 with setSoTimeout(0) — the socket never times out — and captures keystrokes, SMS messages, screen content, and banking app interactions.

Campaign infrastructure spans 350+ identified domains since 2019, connected to a centralized Neon PostgreSQL database that preserves victim credentials, active sessions, and affiliate accounts across domain rotations. The platform is advertised openly on Facebook groups ('Base de Datos', 'Bases de datos Negocios Serios') and affiliates register via a Telegram bot with SuperAdmin approval (handle 'balonx'). The admin panel at /balonx path provides link generation, session management, per-bank targeting via allowedBanks permission matrix, credential display, and credit card information visibility. The operator maintains a hierarchical structure with Admin, Manager, and Executive roles, with Executive authentication via one-time passwords sent through Telegram. Estimated earnings from the operation are ~$1,728,000 MXN (~$99,384 USD), with 12 registered steady scammers in the admin panel. The campaign targets Banamex and at least 20 other Mexican financial institutions.

MITRE ATT&CK techniques by tactic:

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1573.002 Asymmetric Cryptography

Credential Access

T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie

Execution

T1204.002 User Execution: Malicious File

Collection

T1557 Adversary-in-the-Middle

Initial Access

T1566.002 Spearphishing Link; T1566.004 Spearphishing Voice

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1586.001 Compromise Accounts: Social Media Accounts; T1588.002 Obtain Capabilities: Tool

reconnaissance

T1598.003 Phishing for Information: Spearphishing Link

stealth

T1684.001 Impersonation

Remediation for Balonx Sistema AI vishing campaign

Immediate actions

• Block all known Balonx infrastructure domains and IPs at perimeter (196.251.84.11, 85.31.235.109, aclaraciones-digital.online, soporte-aclaracion.xyz, balonx.online, callbalonx.info, panelbalonxfs.xyz)
• Block port 7771/TCP and 5160/TCP outbound at network perimeter
• Issue customer alerts about impersonation calls from 'Carolina' and fake bank protection APK installation requests
• Monitor for /ws endpoint connections to known phishing domains in web proxy logs
• Block panelbalonxfs.xyz API endpoints (GraphQL, REST, auth token) at network level

Workarounds

• End unexpected calls claiming to be from the bank; independently call the number on the back of the card or official banking app
• Never install APK files suggested by callers or unverified websites
• Treat any request for PIN, CVV, card scan, or remote APK installation as a warning sign
• Enable multi-factor authentication with FIDO2 security keys where available instead of SMS-based OTP

Longer-term hardening

• Deploy FIDO2 hardware security keys for high-value customers to defeat real-time AitM relay attacks
• Implement behavioral detection for WebSocket-based AitM phishing patterns
• Establish continuous monitoring for domain registrations matching Aclaraciones Bancarias naming patterns
• Deploy Endpoint Detection and Response (EDR) on mobile devices with Android RAT behavior detection
• Implement SMS-based suspicious activity monitoring for account takeovers
• Collaborate with Mexican financial sector CERT for cross-institution threat sharing

Affected and fixed versions

• Banamex — Online Banking
  Vulnerable versions: all
• Multiple Mexican Financial Institutions — Online Banking
  Vulnerable versions: 20+ institutions targeted

Timeline of Balonx Sistema AI vishing campaign

Last updated 2026-08-20

• 2019 Earliest domain registration linked to the Aclaraciones Bancarias campaign lineage, indicating the broader infrastructure spans multiple related operations predating Balonx
• 2025-06 GitHub repository activity marks the beginning of Balonx PhaaS platform development, including the locked-ioc-18 AI vishing module and WebSocket AitM phishing kit
• 2025-10 First observed credential harvesting by Balonx affiliates; 1,100+ victims begin accumulating across 20+ Mexican financial institutions
• 2025-10-04 Hardcoded reference date in the Balonx PhaaS platform marking the commercial launch of the subscription-based phishing service
• 2026-08-19 Campaign remains active with continuous domain rotation; affiliates continue targeting Mexican financial institutions; no known takedown of core infrastructure
• 2026-08-19 Group-IB publishes comprehensive Balonx Sistema analysis following discovery of leaked GitHub repositories exposing hardcoded credentials, infrastructure, and affiliate network

Update history

• 2026-08-20 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 1 newly-corroborated indicator(s).

Sources cited for Balonx Sistema AI vishing campaign

• Balonx Sistema: The Face Behind the PhaaS Affecting Mexico's Financial Sector group-ib.com · Research · 2026-08-19
• Hybrid Analysis — balonxonline.pro Malicious Domain Detection hybrid-analysis.com · Research · 2026-08-19
• Spyroid RAT v7.7 — Commercial Android Remote Access Trojan blankhack.com · Research · 2026-01-01
• Group-IB LATAM Intelligence Insights Report, Q2 2026 group-ib.com · Research · 2026-07-09
• Hackers Use AI Voice Calls and Fake Banking Pages to Bypass MFA and Steal Accounts cybersecuritynews.com · News · 2026-08-19

Threats related to Balonx Sistema AI vishing campaign

• Balonx Sistema: Mexican Phishing-as-a-Service Platform Combines Real-Time MITM, Android RAT, and AI Vishing to Target 20+ Financial Institutions
• Malwarebytes: Scammers Increasingly Match Scam Type to Platform, Targeting Victims by Channel and Time
• Invisible Unicode Tag Characters Used to Evade Phishing Detection in Financial Scam Campaign
• Proofpoint 2026 AI-Era Ransomware Report: 65% of Victims Report AI Increased Attack Effectiveness
• Top Phishing-Kit Platforms Driving AiTM Session-Theft and MFA-Bypass Campaigns (SOCRadar, Aug 2026)

Related coverage of this activity

• SafePal order-tracking IDOR
• Balonx PhaaS banking malware
• Tycoon2FA legal-sector AiTM phishing
• Instagram Meta AI recovery flaw
• AnonyMousKIT Apple ID theft PhaaS