# Balonx Sistema: Mexican Phishing-as-a-Service Platform Combines Real-Time MITM, Android RAT, and AI Vishing to Target 20+ Financial Institutions

> Group-IB documented Balonx Sistema, a Mexico-based Phishing-as-a-Service platform run by an operator using the handle "balonx" that has targeted more than 20 Mexican financial institutions since October 2025, combining WebSocket-based real-time MITM phishing across 14 fraudulent screen types, a Spyroid-based Android RAT (tracked as BankProtect), and an AI-driven vishing module (CallFlow) built on GPT-4o-mini, ElevenLabs, and Whisper. The platform is sold as a weekly subscription service and had collected 1,100+ victim records and generated an estimated 1,728,000 MXN (~$99,384 USD) from 12 active operators at the time of analysis.

- **Published:** 2026-08-25T00:00:00Z
- **Last reviewed:** 2026-08-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2143
- **ID:** TL-2026-2143
- **Severity:** CRITICAL
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** Balonx
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Balonx Sistema is a fully productized Phishing-as-a-Service (PhaaS) platform operated out of Mexico under the SuperAdmin account handle "balonx," marketed under the "Aclaraciones Bancarias" (Bank Clarifications) social-engineering theme. Rather than selling static phishing kits, the operator rents live operational access on a recurring weekly basis via two subscription tiers paid through the Mexican crypto exchange Bitso, with subscription verification fully automated via the Bitso API: an Individual Plan (3,000 MXN/week, 2-device limit) and an Office Plan (6,000 MXN/week, 8 executive sub-accounts). A hardcoded October 4, 2025 reference date in the platform code marks its commercial launch.

The core of the platform is a persistent, bidirectional WebSocket channel (the /ws endpoint, present on every active Balonx phishing domain) that gives a human operator real-time control over what a victim sees during a live phishing session, driven by a SCREEN_CHANGE protocol message. Operators can push any of 14 distinct fraudulent screen types on demand — including FOLIO (case number), VALIDANDO (loading), LOGIN (credential capture), CODIGO (OTP/MFA interception), NIP (ATM PIN), TARJETA (card/CVV/expiration), SMS_COMPRA (purchase-authorization OTP), CANCELACION_RETIRO (cardless-withdrawal codes), ESCANEAR_QR (physical card QR capture), PROTECCION_BANCARIA (malicious APK delivery), PROTECCION_SALDO (balance capture), VERIFICACION_ID (ID/passport and biometric/camera capture), MENSAJE (custom messaging), and CANCELACION (session close). The CODIGO and SMS_COMPRA screens are purpose-built to intercept one-time passcodes before they expire, letting operators relay stolen credentials into the real banking portal in real time and thereby defeat MFA; the platform preconfigures bank-specific workflows that automate the credential-to-OTP progression.

The PROTECCION_BANCARIA screen is used to distribute an Android RAT disguised as a bank security alert, delivered through the phishing session itself rather than any app store. The APK (package sacred.explosion, main class bxelllolzxqfmaszk1049) is built on the commercial Spyroid RAT-as-a-Service framework and is tracked by Group-IB as BankProtect. It maintains a persistent raw TCP socket (setSoTimeout(0)) to a C2 server at 196.251.84.11:7771, authenticated with a hardcoded Base64-encoded connection key (host and port are themselves Base64-encoded in the APK: MTk2LjI1MS44NC4xMQ== / Nzc3MQ==), and provides keylogging, screenshot/screen-recording capture, file management, SMS interception, social-media/banking-app monitoring, and full remote device control.

A third module, CallFlow, automates voice fraud (vishing) at scale: victims are called by a bot that uses OpenAI GPT-4o-mini for real-time conversational dialogue, ElevenLabs (voice profile "Carolina") as the primary text-to-speech engine with an OpenAI "echo" voice as fallback, and OpenAI Whisper to transcribe victim speech in real time, all impersonating a bank representative indistinguishable from a human call-center operator. The backend runs on FreePBX 17.0.4.31/17.0.28 with a SIP server at 85.31.235.109:5160, supporting 30 concurrent call channels, which Group-IB assesses removes the human-operator bottleneck and lets a single operator run hundreds of simultaneous fraudulent calls; Manager-tier accounts can covertly listen to any active call in real time using Asterisk's ChanSpy feature. Access to CallFlow and the administrative backend is served from callbalonx.info and panelbalonxfs.xyz (GraphQL, REST, and token-auth endpoints under /admin/api/api/), backed by a centralized Neon PostgreSQL database that preserves victim data continuity as the operation rotates across phishing domains. Group-IB links over 350 domains to the Balonx/Aclaraciones Bancarias infrastructure going back to 2019, including aclaraciones-digital.online, soporte-aclaracion.xyz, and balonx.online.

Affiliate onboarding runs through a Telegram bot that assigns each new operator a unique affiliate ID, subject to explicit SuperAdmin approval; Office Plan Executive sub-accounts authenticate via one-time passwords delivered over Telegram, and a per-executive "allowedBanks" permission matrix restricts which institutions each sub-account may target. The operation promotes itself and recruits new operators through Facebook groups oriented around data trading and telemarketing fraud ("Base de Datos," "Bases de datos Negocios Serios"), using demonstration videos of the live-control panel and what Group-IB assesses are likely SuperAdmin-run sock-puppet accounts.

Since October 2025 the platform has been used by 12 active operators to harvest 1,100+ victim credential/financial records from customers of more than 20 Mexican financial institutions, generating an estimated 1,728,000 MXN (~$99,384 USD) in subscription revenue — part of a broader regional trend in which Mexico ranks second only to Brazil for banking-malware incidents in Latin America. Group-IB was able to identify the operator behind the "balonx" handle after discovering hardcoded credentials and operational infrastructure — including C2 coordinates, victim telemetry, and the full affiliate/operator hierarchy — exposed in a public GitHub repository used during platform development (activity dating to June 2025), and references Mexico's financial-consumer-protection agency CONDUSEF as the relevant regulatory contact for affected customers.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1566.004 Spearphishing Voice
- T1660 Phishing
- T1557 Adversary-in-the-Middle
- T1111 Multi-Factor Authentication Interception
- T1056.003 Web Portal Capture
- T1513 Screen Capture
- T1417.001 Keylogging
- T1636.004 SMS Messages
- T1533 Data from Local System
- T1509 Non-Standard Port
- T1684.001 Impersonation
- T1583.001 Domains
- T1587.001 Malware
- T1588.002 Tool
- T1586.001 Social Media Accounts
- T1657 Financial Theft

## Sources

- [Balonx Sistema: The Face Behind the PhaaS Affecting Mexican Banking (ES)](https://www.group-ib.com/blog/balonx-sistema-mexico-phaas-es/)
- [Balonx Sistema: The Face Behind the PhaaS Affecting Mexican Banking](https://www.group-ib.com/blog/balonx-sistema-mexico-phaas/)
- [Hackers Use AI Voice Calls and Fake Banking Pages to Bypass MFA and Steal Accounts](https://cybersecuritynews.com/hackers-use-ai-voice-calls/)
- [Balonx PhaaS Steals Bank OTPs in Real Time While AI Calls and Android RAT Target Victims](https://gbhackers.com/balonx-phaas-steals-bank-otps/)
- [Balonx PhaaS Targets 20+ Mexican Banks With Real-Time MFA Bypass, Android RAT and AI Vishing](https://cyberpress.org/balonx-targets-mexican-banks/)
- [Group-IB Global: Balonx Sistema technical thread (WebSocket MITM, Spyroid RAT/BankProtect, AI vishing)](https://x.com/GroupIB/status/2089982967934570718)
- [Group-IB Global: Balonx Sistema technical thread (14 screen types, C2 infrastructure, affiliate management)](https://x.com/GroupIB/status/2089982978579669439)
- [Balonx Sistema: The Face Behind the PhaaS Affecting Mexican Banking - Live Threat Intelligence](https://radar.offseq.com/threat/balonx-sistema-the-face-behind-the-phaas-affecting-mexican-banking-5367c1fab1cf7b61)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2143