Skip to navigation

Threat reportPhishingTL-2026-2143

Balonx Sistema: Mexican Phishing-as-a-Service Platform Combines Real-Time MITM, Android RAT, and AI Vishing to Target 20+ Financial Institutions

criticalACTIVE

Group-IB documented Balonx Sistema, a Mexico-based Phishing-as-a-Service platform run by an operator using the handle "balonx" that has targeted more than 20 Mexican financial institutions since October 2025, combining WebSocket-based real-time MITM phishing across 14 fraudulent screen types, a Spyroid-based Android RAT (tracked as BankProtect), and an AI-driven vishing module (CallFlow) built on GPT-4o-mini, ElevenLabs, and Whisper.

Key facts for Balonx Sistema banking PhaaS

IdentifiersTL-2026-2143
Also known asAclaraciones Bancarias
SeverityCRITICAL
Exploitation statusExploited in the wild
Affected productsMultiple Mexican financial institutions Online/mobile banking customers (20+ institutions); Google Android OS
AttributionBalonx (high confidence)
MalwareBankProtect, Spyroid
ToolsAsterisk ChanSpy, ElevenLabs, FreePBX, GPT-4o-mini, Telegram, Whisper
MITRE ATT&CK techniquesT1056.003 Web Portal Capture, T1111 Multi-Factor Authentication Interception, T1417.001 Keylogging, T1509 Non-Standard Port, T1513 Screen Capture, T1533 Data from Local System, T1557 Adversary-in-the-Middle, T1566.002 Spearphishing Link, T1566.004 Spearphishing Voice, T1583.001 Domains, T1586.001 Social Media Accounts, T1587.001 Malware and 5 more in the attack flow
MotivationFINANCIAL
Target sectorsfinancial services, banking
Target regionsmexico, Latin America
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage for Balonx Sistema banking PhaaS

As of 2026-08-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2143 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Balonx Sistema Aclaraciones Bancarias Phishing Domain & /ws WebSocket MITM Access

Detects proxy/DNS telemetry showing an endpoint reaching a known Balonx Sistema / Aclaraciones Bancarias phishing domain (balonx.online, panelbalonxfs.xyz, callbalonx.info, aclaraciones-digital.online, soporte-aclaracion.xyz) or a newly registered domain matching the operator's aclaraciones-*/balonx-*/panelbalonx* naming convention, with special weight on requests to the /ws path that carries the SCREEN_CHANGE protocol used to drive the platform's 14 live fraudulent screen types (FOLIO, LOGIN, CODIGO, TARJETA, PROTECCION_BANCARIA, etc.). A hit here means a user session is or was under live operator control in a real-time MITM phishing panel.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1566.002, T1660, T1583.001, T1557
  • Data sources: proxy, dns_logs, web_gateway
  • Severity: critical
  • Confidence: high

Splunk SPL

index=proxy sourcetype=proxy earliest=-24h
| eval domain=lower(url_domain)
| eval known_domain=if(match(domain, "(?i)^(balonx\.online|panelbalonxfs\.xyz|callbalonx\.info|aclaraciones-digital\.online|soporte-aclaracion\.xyz)$"), 1, 0)
| eval pattern_domain=if(match(domain, "(?i)^(aclaraciones-|balonx-|panelbalonx)"), 1, 0)
| where known_domain=1 OR pattern_domain=1
| eval ws_endpoint=if(match(url_path, "(?i)\/ws"), "yes", "no")
| stats count min(_time) as first_seen max(_time) as last_seen values(url_path) as paths_seen values(ws_endpoint) as ws_hit by src_ip, user, domain
| where count > 0
| sort -count

Microsoft KQL

let KnownDomains = dynamic(["balonx.online","panelbalonxfs.xyz","callbalonx.info","aclaraciones-digital.online","soporte-aclaracion.xyz"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (KnownDomains) or RemoteUrl matches regex @"(?i)^(https?:\/\/)?(aclaraciones-|balonx-|panelbalonx)"
| extend WsHit = iff(RemoteUrl has "/ws", "yes", "no")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, WsHit
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Requests=count(), WsHits=countif(WsHit=="yes") by DeviceName, InitiatingProcessAccountName, RemoteUrl

Sigma

title: Balonx Sistema Aclaraciones Bancarias Phishing Domain Access
id: 7c1e4a2e-4f3b-4b7e-9c6a-1a2b3c4d5e6f
status: experimental
description: Detects proxy access to known Balonx Sistema / Aclaraciones Bancarias PhaaS phishing domains or the operator's aclaraciones-*/balonx-*/panelbalonx* naming pattern, including the /ws real-time MITM WebSocket endpoint.
references:
  - https://www.group-ib.com/blog/balonx-sistema-mexico-phaas/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-26
tags:
  - attack.initial-access
  - attack.t1566.002
  - attack.t1660
  - attack.t1583.001
  - attack.credential-access
  - attack.t1557
logsource:
  category: proxy
detection:
  selection_known_domain:
    c-uri-host|endswith:
      - 'balonx.online'
      - 'panelbalonxfs.xyz'
      - 'callbalonx.info'
      - 'aclaraciones-digital.online'
      - 'soporte-aclaracion.xyz'
  selection_pattern_domain:
    c-uri-host|re: '(?i)^(aclaraciones-|balonx-|panelbalonx)'
  selection_ws:
    cs-uri-stem|contains: '/ws'
  condition: selection_known_domain or selection_pattern_domain or (selection_ws and (selection_known_domain or selection_pattern_domain))
falsepositives:
  - Security researchers or takedown vendors crawling the phishing infrastructure
level: critical

Known false positives:

  • Threat-intel/takedown-vendor crawlers or sandboxes intentionally visiting the phishing domains for research

Tuning notes: Feed the domain list from a maintained IOC list rather than hardcoding, and add any newly observed aclaraciones-*/balonx-*/panelbalonx* registrations surfaced by passive-DNS/domain-monitoring. Exclude known internal vulnerability-scanning or brand-protection crawler source IPs.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Balonx CallFlow AI Vishing Callback & Aclaraciones Bancarias Lure Correlation · unlock with TL Creds
  • BankProtect RAT SMS/File Collection and Local-System Exfiltration Staging · unlock with TL Creds
  • Long-Lived Outbound Session to BankProtect C2 Port 7771 (Beacon Duration Anomaly) · unlock with TL Creds
  • Balonx Sistema Phishing Domain Naming-Pattern Match (Sigma) · unlock with TL Creds
  • BankProtect RAT Sideload via Non-Play-Store Source (Sigma) · unlock with TL Creds
  • CallFlow FreePBX/Asterisk ChanSpy Covert Call-Monitoring Activity (Sigma) · unlock with TL Creds
  • BankProtect (Spyroid) Android RAT Sideload & On-Device Collection via PROTECCION_BANCARIA Lure · unlock with TL Creds
  • BankProtect Persistent C2 Beacon & CallFlow SIP/FreePBX Infrastructure Contact · unlock with TL Creds

Indicators of compromise for Balonx Sistema banking PhaaS

As of 2026-08-25, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-2143.

Sample indicators (3 of 26)

  • IP address: 196.251.84[.]11
  • Domain: aclaraciones-digital[.]online
  • IP address: 85.31.235[.]109

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

26 indicators of compromise · unlock with TL Creds. Compare plans

Community OSINT corroboration for Balonx Sistema banking PhaaS

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Balonx Sistema banking PhaaS works

The platform is sold as a weekly subscription service and had collected 1,100+ victim records and generated an estimated 1,728,000 MXN (~$99,384 USD) from 12 active operators at the time of analysis.

Balonx Sistema is a fully productized Phishing-as-a-Service (PhaaS) platform operated out of Mexico under the SuperAdmin account handle "balonx," marketed under the "Aclaraciones Bancarias" (Bank Clarifications) social-engineering theme. Rather than selling static phishing kits, the operator rents live operational access on a recurring weekly basis via two subscription tiers paid through the Mexican crypto exchange Bitso, with subscription verification fully automated via the Bitso API: an Individual Plan (3,000 MXN/week, 2-device limit) and an Office Plan (6,000 MXN/week, 8 executive sub-accounts). A hardcoded October 4, 2025 reference date in the platform code marks its commercial launch.

The core of the platform is a persistent, bidirectional WebSocket channel (the /ws endpoint, present on every active Balonx phishing domain) that gives a human operator real-time control over what a victim sees during a live phishing session, driven by a SCREEN_CHANGE protocol message. Operators can push any of 14 distinct fraudulent screen types on demand — including FOLIO (case number), VALIDANDO (loading), LOGIN (credential capture), CODIGO (OTP/MFA interception), NIP (ATM PIN), TARJETA (card/CVV/expiration), SMS_COMPRA (purchase-authorization OTP), CANCELACION_RETIRO (cardless-withdrawal codes), ESCANEAR_QR (physical card QR capture), PROTECCION_BANCARIA (malicious APK delivery), PROTECCION_SALDO (balance capture), VERIFICACION_ID (ID/passport and biometric/camera capture), MENSAJE (custom messaging), and CANCELACION (session close). The CODIGO and SMS_COMPRA screens are purpose-built to intercept one-time passcodes before they expire, letting operators relay stolen credentials into the real banking portal in real time and thereby defeat MFA; the platform preconfigures bank-specific workflows that automate the credential-to-OTP progression.

The PROTECCION_BANCARIA screen is used to distribute an Android RAT disguised as a bank security alert, delivered through the phishing session itself rather than any app store. The APK (package sacred.explosion, main class bxelllolzxqfmaszk1049) is built on the commercial Spyroid RAT-as-a-Service framework and is tracked by Group-IB as BankProtect. It maintains a persistent raw TCP socket (setSoTimeout(0)) to a C2 server at 196.251.84.11:7771, authenticated with a hardcoded Base64-encoded connection key (host and port are themselves Base64-encoded in the APK: MTk2LjI1MS44NC4xMQ== / Nzc3MQ==), and provides keylogging, screenshot/screen-recording capture, file management, SMS interception, social-media/banking-app monitoring, and full remote device control.

A third module, CallFlow, automates voice fraud (vishing) at scale: victims are called by a bot that uses OpenAI GPT-4o-mini for real-time conversational dialogue, ElevenLabs (voice profile "Carolina") as the primary text-to-speech engine with an OpenAI "echo" voice as fallback, and OpenAI Whisper to transcribe victim speech in real time, all impersonating a bank representative indistinguishable from a human call-center operator. The backend runs on FreePBX 17.0.4.31/17.0.28 with a SIP server at 85.31.235.109:5160, supporting 30 concurrent call channels, which Group-IB assesses removes the human-operator bottleneck and lets a single operator run hundreds of simultaneous fraudulent calls; Manager-tier accounts can covertly listen to any active call in real time using Asterisk's ChanSpy feature. Access to CallFlow and the administrative backend is served from callbalonx.info and panelbalonxfs.xyz (GraphQL, REST, and token-auth endpoints under /admin/api/api/), backed by a centralized Neon PostgreSQL database that preserves victim data continuity as the operation rotates across phishing domains. Group-IB links over 350 domains to the Balonx/Aclaraciones Bancarias infrastructure going back to 2019, including aclaraciones-digital.online, soporte-aclaracion.xyz, and balonx.online.

Affiliate onboarding runs through a Telegram bot that assigns each new operator a unique affiliate ID, subject to explicit SuperAdmin approval; Office Plan Executive sub-accounts authenticate via one-time passwords delivered over Telegram, and a per-executive "allowedBanks" permission matrix restricts which institutions each sub-account may target. The operation promotes itself and recruits new operators through Facebook groups oriented around data trading and telemarketing fraud ("Base de Datos," "Bases de datos Negocios Serios"), using demonstration videos of the live-control panel and what Group-IB assesses are likely SuperAdmin-run sock-puppet accounts.

Since October 2025 the platform has been used by 12 active operators to harvest 1,100+ victim credential/financial records from customers of more than 20 Mexican financial institutions, generating an estimated 1,728,000 MXN (~$99,384 USD) in subscription revenue — part of a broader regional trend in which Mexico ranks second only to Brazil for banking-malware incidents in Latin America. Group-IB was able to identify the operator behind the "balonx" handle after discovering hardcoded credentials and operational infrastructure — including C2 coordinates, victim telemetry, and the full affiliate/operator hierarchy — exposed in a public GitHub repository used during platform development (activity dating to June 2025), and references Mexico's financial-consumer-protection agency CONDUSEF as the relevant regulatory contact for affected customers.

MITRE ATT&CK techniques by tactic:

Credential Access

T1056.003 Web Portal Capture; T1111 Multi-Factor Authentication Interception; T1557 Adversary-in-the-Middle

Collection

T1417.001 Keylogging; T1513 Screen Capture; T1533 Data from Local System; T1636.004 SMS Messages

Command and Control

T1509 Non-Standard Port

Initial Access

T1566.002 Spearphishing Link; T1566.004 Spearphishing Voice; T1660 Phishing

Resource Development

T1583.001 Domains; T1586.001 Social Media Accounts; T1587.001 Malware; T1588.002 Tool

Impact

T1657 Financial Theft

Stealth

T1684.001 Impersonation

Remediation for Balonx Sistema banking PhaaS

Immediate actions

  • Block the identified Balonx/Aclaraciones Bancarias domains and the 196.251.84.11 and 85.31.235.109 IPs at the perimeter/DNS layer.
  • Alert customers of Mexican financial institutions to unsolicited 'Aclaraciones Bancarias' links, SMS/WhatsApp messages, and inbound calls requesting OTP/PIN/card data.
  • Force session/credential resets and out-of-band re-verification for any accounts observed interacting with known Balonx phishing domains.
  • Instruct mobile users to never sideload APKs prompted by a 'banking security' pop-up (PROTECCION_BANCARIA lure) and to check device admin/accessibility permission grants for the sacred.explosion package.

Workarounds

  • Educate customers that legitimate banks never ask for a full OTP/CVV/PIN over a live chat, WebSocket-driven web page, or automated phone call.

Longer-term hardening

  • Deploy out-of-band, push-based (not SMS/voice-relayed) MFA that cannot be relayed through a live operator-in-the-loop phishing panel.
  • Deploy mobile threat defense / EDR on customer-facing banking apps capable of detecting Spyroid-derived RATs and unofficial APK sideloading.
  • Implement voice-biometric or callback-based verification for any inbound call claiming to be from bank fraud/support lines to counter AI-vishing impersonation.
  • Monitor for newly registered domains following the aclaraciones-*/balonx-*/panelbalonx* naming and WebSocket-based phishing kit patterns.

Affected and fixed versions

  • Multiple Mexican financial institutions — Online/mobile banking customers (20+ institutions)
    Vulnerable versions: N/A - customers targeted via social engineering, not a software vulnerability
  • Google — Android OS
    Vulnerable versions: Any Android device on which the sacred.explosion APK is sideloaded outside Google Play

Timeline of Balonx Sistema banking PhaaS

  • Earliest domains later linked to the locked-ioc-25/Aclaraciones Bancarias infrastructure (locked-ioc-6, locked-ioc-7, locked-ioc-15 among 350+ total) begin appearing, per Group-IB's historical domain-rotation analysis (year-level precision only).
  • locked-ioc-24 repository activity shows active development of the locked-ioc-25 platform and the CallFlow AI vishing module (month-level precision only).
  • locked-ioc-25 Sistema PhaaS commercially launches (hardcoded reference date in platform code); weekly subscription tiers (Individual 3,000 MXN, Office 6,000 MXN) go live, billed via the locked-ioc-26 crypto exchange API with fully automated subscription verification.
  • Platform begins actively harvesting victim credentials, OTPs, card data, and identity documents from customers of 20+ Mexican financial institutions.
  • At time of Group-IB's analysis, 12 active operators are subscribed to the platform, having collectively generated an estimated 1,728,000 MXN (~$99,384 USD) and harvested 1,100+ victim records since October 2025 (month-level precision only).
  • Group-IB publishes the original 'locked-ioc-25 Sistema: The Face Behind the PhaaS Affecting Mexican Banking' technical analysis, detailing the WebSocket MITM mechanics, the Spyroid-based Android RAT (locked-ioc-16), the CallFlow AI vishing infrastructure, and the affiliate/operator hierarchy.
  • Derivative coverage of the Group-IB findings is published by CyberSecurityNews, GBHackers, and CyberPress, and the Spanish-language Group-IB blog post goes live, broadening public disclosure of the locked-ioc-25 Sistema campaign.
  • Group-IB identifies the operator behind the 'locked-ioc-25' SuperAdmin account after discovering hardcoded credentials and operational infrastructure exposed in a public locked-ioc-24 repository.

Sources cited for Balonx Sistema banking PhaaS

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats