# Balonx Sistema: Mexican Banking PhaaS with BankProtect Android RAT and CallFlow AI Vishing

> Balonx Sistema is a subscription-based Phishing-as-a-Service platform targeting over 20 Mexican financial institutions. It combines WebSocket-controlled real-time credential and OTP interception, the BankProtect Android RAT (Spyroid-based, package sacred.explosion), and CallFlow, an AI-driven voice fraud module. Group-IB reports 1,100+ credentials harvested since October 2025 and live C2 infrastructure at publication.

- **Published:** 2026-10-14T20:01:03Z
- **Last reviewed:** 2026-10-14T20:01:03Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3544
- **ID:** TL-2026-3544
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** Balonx (Mexico)
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Balonx Sistema is an industrialized Phishing-as-a-Service (PhaaS) operation aimed at customers of more than 20 Mexican financial institutions (Banamex is the one specifically named in the public reporting). It descends from an earlier 'Aclaraciones Bancarias' campaign whose domain registrations date back to 2019; Group-IB links 350+ domains to the two campaigns. Development activity appears in a GitHub repository from June 2025, a commercial launch date of 4 October 2025 is hardcoded, and Group-IB reports 1,100+ user credentials harvested since October 2025. All phishing domains are backed by a single central Neon PostgreSQL database, so victim data, live sessions and affiliate accounts survive domain takedown and re-registration.

The platform is sold by subscription: an Individual tier (3,000 MXN/week, 2 devices) and an Office tier (6,000 MXN/week, 8 Executive sub-accounts), with payments integrated with the Bitso API. Affiliates register through a Telegram bot, require approval from the SuperAdmin account 'balonx', and Executives authenticate with one-time Telegram passwords; an 'allowedBanks' permission field controls which banks each Executive may target. Group-IB estimated roughly 1,728,000 MXN (about USD 99,385) of observed proceeds across 12 steady users. The service is advertised in Facebook groups such as 'Base de Datos' and 'Bases de datos Negocios Serios'. Victims are lured with phishing links distributed over Telegram and WhatsApp that pose as bank clarification/cancellation/support requests; sessions are hosted at a single domain with folio-style paths (for example /12345).

The phishing portal uses a persistent WebSocket endpoint (/ws, present on all active Balonx phishing domains) that gives the operator live operator-in-the-middle control. The operator watches the victim's input, relays credentials to the genuine banking portal, receives the MFA challenge, and pushes a SCREEN_CHANGE to the victim (for example CODIGO) asking for the same OTP before it expires. Fourteen screen types are used: FOLIO, VALIDANDO, LOGIN, CODIGO (SMS OTP), NIP (ATM PIN), TARJETA (card number/expiry/CVV), SMS_COMPRA (purchase authorization OTP), CANCELACION_RETIRO (cardless withdrawal codes), ESCANEAR_QR (physical card QR scan), PROTECCION_BANCARIA (APK distribution), PROTECCION_SALDO (balance capture), VERIFICACION_ID (ID/selfie capture through the camera to bypass KYC), MENSAJE (custom operator message) and CANCELACION (completion). 'Personal Flows' pre-script per-bank screen sequences that advance on a timer or on data submission. The admin panel exposes GraphQL, REST and token-auth endpoints under panelbalonxfs[.]xyz/admin/api/api/.

The PROTECCION_BANCARIA screen shows a fake bank security alert that pushes victims to install a 'protection' app. This is BankProtect, an Android RAT built on the commercial Spyroid RAT (Spyroid.net), package name sacred.explosion, main class bxelllolzxqfmaszk1049. Its C2 is hardcoded as Base64 strings (ClientHost MTk2LjI1MS44NC4xMQ== = 196.251.84.11, ClientPort Nzc3MQ== = 7771) and it uses a persistent raw TCP socket (setSoTimeout(0)) with a ConnectionKey. Capabilities reported: real-time keylogging and screen capture, SMS interception, social-media account hijacking, full remote device control and monitoring of banking app activity. The C2 at 196.251.84.11:7771/TCP was live at publication.

CallFlow is the third pillar: an automated outbound vishing module (callbalonx[.]info) that impersonates a bank agent named 'Carolina'. It uses OpenAI GPT-4o-mini for dialogue, ElevenLabs (voice 'carolina') as primary TTS with OpenAI voice 'echo' as fallback, and OpenAI Whisper for speech recognition, on a FreePBX (17.0.4.31 / 17.0.28) PBX with 30 default SIP channels. The SIP server was observed at 85.31.235.109:5160/TCP, the FreePBX backend/UCP at panelbalonxfs[.]xyz, and manager accounts can use Asterisk ChanSpy to listen to live calls. Together these remove the need for human call-centre operators and allow large-scale simultaneous vishing. No CVEs are associated; CVSS is not applicable. BeaconBeagle returned no beacon records for the two IPs (404) and no config matches for balonx.online at the time of research.

## MITRE ATT&CK

- T1583.001 Domains
- T1585.001 Social Media Accounts
- T1598.003 Spearphishing Link
- T1566.002 Spearphishing Link
- T1660 Phishing
- T1557 Adversary-in-the-Middle
- T1111 Multi-Factor Authentication Interception
- T1539 Steal Web Session Cookie
- T1417.001 Keylogging
- T1636.004 SMS Messages
- T1513 Screen Capture
- T1684.001 Impersonation
- T1095 Non-Application Layer Protocol

## Sources

- [Balonx Sistema: The Face Behind the PhaaS Affecting Mexican Banking](https://www.group-ib.com/blog/balonx-sistema-mexico-phaas/)
- [MITRE ATT&CK T1111 Multi-Factor Authentication Interception](https://attack.mitre.org/techniques/T1111/)
- [MITRE ATT&CK T1557 Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557/)
- [MITRE ATT&CK T1566.002 Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
- [MITRE ATT&CK T1656 Impersonation](https://attack.mitre.org/techniques/T1656/)
- [MITRE ATT&CK Mobile T1660 Phishing](https://attack.mitre.org/techniques/T1660/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3544