# Balonx Sistema PhaaS Campaign — AI Voice Calls and Fake Banking Pages Targeting Mexican Financial Institutions

> Group-IB identified Balonx Sistema, a phishing-as-a-service (PhaaS) subscription platform targeting over 20 Mexican financial institutions. The campaign uses AI-generated voice calls (fabricated bank representative 'Carolina'), real-time adversary-in-the-middle phishing via WebSocket-connected fake banking pages, and an Android RAT (Spyroid-based, package 'sacred.explosion') distributed as a fake bank-protection screen. Credentials and data have been collected from over 1,100 victims since at least October 2025.

- **Published:** 2026-08-19T00:00:00Z
- **Last reviewed:** 2026-08-20T14:17:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2072
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-balonx-sistema-ai-vishing-campaign-tl-2026-2072.webp?v=176dc6d3 (Threadlinqs threat intel: Balonx Sistema: AI Voice Phishing of Banks: Detection & IOCs (TL-2026-2072) — High severity, 20 IOCs, 9 detection rules.)
- **ID:** TL-2026-2072
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Balonx
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (3 shown free below)

## Description

Balonx Sistema is a highly structured, subscription-based Phishing-as-a-Service (PhaaS) platform developed by a Mexico-based cybercriminal operative and exposed by Group-IB following a critical operational security failure — leaked GitHub repositories that revealed hardcoded credentials, infrastructure details, and the full affiliate network. The platform operates as a criminal SaaS model, renting access to sophisticated phishing infrastructure on a weekly subscription basis (Individual: 3,000 MXN/week, ~$172 USD; Office: 6,000 MXN/week, ~$345 USD), with automated payment processing via the Bitso API (Mexican cryptocurrency exchange) and discount code promotional flexibility.

The platform combines three core technical capabilities into a single attack chain. First, the CallFlow AI vishing module uses GPT-4o-mini for conversational dialog generation, ElevenLabs for high-quality synthetic speech (voice profile 'Carolina'), and OpenAI Whisper for real-time speech-to-text transcription, all running on a FreePBX/Asterisk telephony backend (SIP server 85.31.235.109:5160/TCP). CallFlow completely automates outbound vishing calls, impersonating bank representatives without requiring human operators. Managers can covertly monitor active calls via Asterisk ChanSpy. Second, the WebSocket-based adversary-in-the-middle (AitM) phishing platform uses a persistent /ws endpoint on all active phishing domains to maintain a real-time bi-directional link between the victim's browser and the operator's control panel. The operator can dynamically push 14 distinct screen types (FOLIO, VALIDANDO, LOGIN, CODIGO for OTPs, NIP for ATM PINs, TARJETA for card details, SMS_COMPRA for purchase authorization, CANCELACION_RETIRO for cardless withdrawal codes, ESCANEAR_QR for physical card QR scans, PROTECCION_BANCARIA for APK delivery, PROTECCION_SALDO for balance capture, VERIFICACION_ID for ID/selfie theft via camera, MENSAJE for custom messages, and CANCELACION for completion). Affiliates can also pre-configure automated screen sequences via 'Mi Flujo Personal' (Personal Flows) that auto-execute, enabling less skilled operators to run sophisticated sessions. Third, an Android RAT built on the commercial Spyroid framework (package name: 'sacred.explosion', main class: 'bxelllolzxqfmaszk1049') is distributed through the PROTECCION_BANCARIA screen as a fake bank security alert. The RAT establishes a persistent TCP connection to C2 at 196.251.84.11:7771 with setSoTimeout(0) — the socket never times out — and captures keystrokes, SMS messages, screen content, and banking app interactions.

Campaign infrastructure spans 350+ identified domains since 2019, connected to a centralized Neon PostgreSQL database that preserves victim credentials, active sessions, and affiliate accounts across domain rotations. The platform is advertised openly on Facebook groups ('Base de Datos', 'Bases de datos Negocios Serios') and affiliates register via a Telegram bot with SuperAdmin approval (handle 'balonx'). The admin panel at /balonx path provides link generation, session management, per-bank targeting via allowedBanks permission matrix, credential display, and credit card information visibility. The operator maintains a hierarchical structure with Admin, Manager, and Executive roles, with Executive authentication via one-time passwords sent through Telegram. Estimated earnings from the operation are ~$1,728,000 MXN (~$99,384 USD), with 12 registered steady scammers in the admin panel. The campaign targets Banamex and at least 20 other Mexican financial institutions.

## MITRE ATT&CK

- T1566.004 Spearphishing Voice
- T1566.002 Spearphishing Link
- T1684.001 Impersonation
- T1204.002 User Execution: Malicious File
- T1111 Multi-Factor Authentication Interception
- T1539 Steal Web Session Cookie
- T1557 Adversary-in-the-Middle
- T1598.003 Phishing for Information: Spearphishing Link
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.002 Asymmetric Cryptography
- T1583.001 Acquire Infrastructure: Domains
- T1586.001 Compromise Accounts: Social Media Accounts
- T1588.002 Obtain Capabilities: Tool

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Balonx WebSocket AitM Phishing Page — Credential Harvesting via /ws Relay** (`TL-2026-2072-SPL-002`)

Detects WebSocket connections to the /ws endpoint on Balonx phishing domains, indicating real-time adversary-in-the-middle (AitM) session relay. The platform uses a persistent bi-directional WebSocket link to dynamically push 14 fraudulent screen types (LOGIN, CODIGO, NIP, TARJETA, SMS_COMPRA, etc.) to steal credentials, OTPs, ATM PINs, card details, and purchase authorization codes from victims of Mexican financial institutions.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1557, T1111, T1539, T1583.001
- **Data sources:** web_proxy, network_firewall, ssl_decryption
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=proxy sourcetype=bluecoat:proxysg uri_path="/ws"
| eval domain_lower=lower(uri_domain)
| eval is_suspicious=case(
    like(domain_lower,"%aclaraciones%"),"phishing_aclaraciones",
    like(domain_lower,"%soporte-aclaracion%"),"phishing_support",
    like(domain_lower,"%balonx%"),"balonx_infrastructure",
    1=1,"unknown")
| search is_suspicious IN ("phishing_aclaraciones","phishing_support","balonx_infrastructure")
| table _time, src_ip, uri_domain, uri_path, http_method, user_agent, referer_domain, is_suspicious
| sort -_time
| eval threat_phase=case(
    is_suspicious="balonx_infrastructure","confirmed_balonx",
    is_suspicious="phishing_aclaraciones","aclaraciones_bancarias_campaign",
    is_suspicious="phishing_support","balonx_support_infra",
    1=1="monitor")
```

### Microsoft KQL

```kql
CommonSecurityLog
| where DeviceVendor == "Blue Coat"
| where RequestURL has "/ws"
| extend Domain = extract(@"https?://([^/]+)", 1, RequestURL)
| extend Path = extract(@"https?://[^/]+(/[^\s]*)", 1, RequestURL)
| where Domain has_any ("aclaraciones", "soporte-aclaracion", "balonx", "callbalonx", "panelbalonxfs")
| extend IsSuspicious = iif(
    Domain has_any ("balonx", "callbalonx", "panelbalonxfs"),
    "confirmed_balonx",
    "monitor_aclaraciones"
)
| project TimeGenerated, SourceIP, Domain, Path, RequestMethod, DeviceAction, IsSuspicious
| sort by TimeGenerated desc
```

### Sigma

```yaml
title: Balonx WebSocket AitM Phishing /ws Endpoint Detection
id: d5b8f4c2-6e9a-4b3d-0f7c-2a4e8b6d9f1c
status: experimental
description: Detects WebSocket connections to /ws endpoints on domains matching the Balonx Aclaraciones Bancarias phishing infrastructure. The platform uses a persistent bi-directional WebSocket relay to enable real-time adversary-in-the-middle (AitM) credential harvesting, OTP interception, and dynamic screen manipulation across 14 distinct screen types targeting Mexican financial institution customers.
references:
  - https://www.group-ib.com/blog/balonx-sistema-mexico-phaas/
  - https://cybersecuritynews.com/hackers-use-ai-voice-calls/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/08/19
tags:
  - attack.collection
  - attack.t1557
  - attack.credential_access
  - attack.t1111
  - attack.t1539
  - attack.resource_development
  - attack.t1583.001
logsource:
  category: proxy
  product: web_proxy
detection:
  selection:
    cs_uri_path|contains:
      - /ws
    cs_uri_domain|contains:
      - aclaraciones
      - soporte-aclaracion
      - balonx
      - callbalonx
      - panelbalonxfs
  condition: selection
falsepositives:
  - Legitimate WebSocket connections used by web applications (chat, collaboration tools, real-time dashboards)
  - WebSocket health checks or monitoring probes
level: high
fields:
  - cs_uri_domain
  - c_ip
  - cs_user_agent
  - cs_referrer
```

**Known false positives:**

- Legitimate WebSocket connections used by web applications (chat, real-time collaboration, monitoring dashboards)
- WebSocket health checks or uptime monitoring probes
- Legitimate banking applications using WebSocket for real-time features

**Tuning notes:** For higher fidelity, correlate /ws connections with phishing page referrers (suspicious banking login pages) and the presence of both credential input fields and OTP submission forms. Tune domain list as new Balonx domains are identified — the campaign rotates domains frequently. Consider adding network traffic analysis for WebSocket upgrade (101 Switching Protocols) responses with atypical origin domains.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Balonx PhaaS Spearphishing Link Delivery via Phishing Domains (locked: unlock with TL Creds)
- Balonx AitM WebSocket Relay — Multi-Factor Authentication Interception (locked: unlock with TL Creds)
- Spyroid RAT — Android Package [indicator] Installation and Execution (locked: unlock with TL Creds)
- Balonx PhaaS Phishing Kit — Fake Banking Page and API Infrastructure (locked: unlock with TL Creds)
- Balonx AitM Session Cookie Theft and WebSocket Relay — Post-Authentication Hijacking (locked: unlock with TL Creds)
- Balonx PhaaS Infrastructure — Domain Rotation and Subdomain Pattern Detection (locked: unlock with TL Creds)
- Balonx CallFlow AI Vishing SIP Outbound Call Detection (locked: unlock with TL Creds)
- Spyroid Android RAT ([indicator]) C2 Communication Detection (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 20)

Defanged, TLP:CLEAR.

- IP address: `196.251.84[.]11`
- Domain: `aclaraciones-digital[.]online`
- IP address: `85.31.235[.]109`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Balonx Sistema: The Face Behind the PhaaS Affecting Mexico's Financial Sector](https://www.group-ib.com/blog/balonx-sistema-mexico-phaas/)
- [Hackers Use AI Voice Calls and Fake Banking Pages to Bypass MFA and Steal Accounts](https://cybersecuritynews.com/hackers-use-ai-voice-calls/)
- [Hybrid Analysis — balonxonline.pro Malicious Domain Detection](https://hybrid-analysis.com/sample/9797426cf6e21bf28d04de0f877f1bc90d0a560752ab1e7119b2db80e1d682a9/699dcf7002a3b8aedf02394d)
- [Spyroid RAT v7.7 — Commercial Android Remote Access Trojan](https://blankhack.com/spyroid-rat-v7-7/)
- [Group-IB LATAM Intelligence Insights Report, Q2 2026](https://www.group-ib.com/resources/research-hub/latam-intelligence-insights-report-q2-2026/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2072