Balonx Sistema is a fully productized Phishing-as-a-Service (PhaaS) platform operated out of Mexico under the SuperAdmin account handle "balonx," marketed under the "Aclaraciones Bancarias" (Bank Clarifications) social-engineering theme. Rather than selling static phishing kits, the operator rents live operational access on a recurring weekly basis via two subscription tiers paid through the Mexican crypto exchange Bitso, with subscription verification fully automated via the Bitso API: an Individual Plan (3,000 MXN/week, 2-device limit) and an Office Plan (6,000 MXN/week, 8 executive sub-accounts). A hardcoded October 4, 2025 reference date in the platform code marks its commercial launch.

The core of the platform is a persistent, bidirectional WebSocket channel (the /ws endpoint, present on every active Balonx phishing domain) that gives a human operator real-time control over what a victim sees during a live phishing session, driven by a SCREEN_CHANGE protocol message. Operators can push any of 14 distinct fraudulent screen types on demand — including FOLIO (case number), VALIDANDO (loading), LOGIN (credential capture), CODIGO (OTP/MFA interception), NIP (ATM PIN), TARJETA (card/CVV/expiration), SMS_COMPRA (purchase-authorization OTP), CANCELACION_RETIRO (cardless-withdrawal codes), ESCANEAR_QR (physical card QR capture), PROTECCION_BANCARIA (malicious APK delivery), PROTECCION_SALDO (balance capture), VERIFICACION_ID (ID/passport and biometric/camera capture), MENSAJE (custom messaging), and CANCELACION (session close). The CODIGO and SMS_COMPRA screens are purpose-built to intercept one-time passcodes before they expire, letting operators relay stolen credentials into the real banking portal in real time and thereby defeat MFA; the platform preconfigures bank-specific workflows that automate the credential-to-OTP progression.

The PROTECCION_BANCARIA screen is used to distribute an Android RAT disguised as a bank security alert, delivered through the phishing session itself rather than any app store. The APK (package sacred.explosion, main class bxelllolzxqfmaszk1049) is built on the commercial Spyroid RAT-as-a-Service framework and is tracked by Group-IB as BankProtect. It maintains a persistent raw TCP socket (setSoTimeout(0)) to a C2 server at 196.251.84.11:7771, authenticated with a hardcoded Base64-encoded connection key (host and port are themselves Base64-encoded in the APK: MTk2LjI1MS44NC4xMQ== / Nzc3MQ==), and provides keylogging, screenshot/screen-recording capture, file management, SMS interception, social-media/banking-app monitoring, and full remote device control.

A third module, CallFlow, automates voice fraud (vishing) at scale: victims are called by a bot that uses OpenAI GPT-4o-mini for real-time conversational dialogue, ElevenLabs (voice profile "Carolina") as the primary text-to-speech engine with an OpenAI "echo" voice as fallback, and OpenAI Whisper to transcribe victim speech in real time, all impersonating a bank representative indistinguishable from a human call-center operator. The backend runs on FreePBX 17.0.4.31/17.0.28 with a SIP server at 85.31.235.109:5160, supporting 30 concurrent call channels, which Group-IB assesses removes the human-operator bottleneck and lets a single operator run hundreds of simultaneous fraudulent calls; Manager-tier accounts can covertly listen to any active call in real time using Asterisk's ChanSpy feature. Access to CallFlow and the administrative backend is served from callbalonx.info and panelbalonxfs.xyz (GraphQL, REST, and token-auth endpoints under /admin/api/api/), backed by a centralized Neon PostgreSQL database that preserves victim data continuity as the operation rotates across phishing domains. Group-IB links over 350 domains to the Balonx/Aclaraciones Bancarias infrastructure going back to 2019, including aclaraciones-digital.online, soporte-aclaracion.xyz, and balonx.online.

Affiliate onboarding runs through a Telegram bot that assigns each new operator a unique affiliate ID, subject to explicit SuperAdmin approval; Office Plan Executive sub-accounts authenticate via one-time passwords delivered over Telegram, and a per-executive "allowedBanks" permission matrix restricts which institutions each sub-account may target. The operation promotes itself and recruits new operators through Facebook groups oriented around data trading and telemarketing fraud ("Base de Datos," "Bases de datos Negocios Serios"), using demonstration videos of the live-control panel and what Group-IB assesses are likely SuperAdmin-run sock-puppet accounts.

Since October 2025 the platform has been used by 12 active operators to harvest 1,100+ victim credential/financial records from customers of more than 20 Mexican financial institutions, generating an estimated 1,728,000 MXN (~$99,384 USD) in subscription revenue — part of a broader regional trend in which Mexico ranks second only to Brazil for banking-malware incidents in Latin America. Group-IB was able to identify the operator behind the "balonx" handle after discovering hardcoded credentials and operational infrastructure — including C2 coordinates, victim telemetry, and the full affiliate/operator hierarchy — exposed in a public GitHub repository used during platform development (activity dating to June 2025), and references Mexico's financial-consumer-protection agency CONDUSEF as the relevant regulatory contact for affected customers.