Top Tweets for #BTMob
🚨 BTMOB turns Android phishing into no‑code device takeover— abusing Accessibility to hijack screens, steal credentials, and bypass 2FA.
🌐 https://t.co/jBIbsMeNqc
#AndroidSecurity #PhishingAlert #BTMOB #CyberThreat
Try it for FREE. 🆓
@James_inthe_box @Fact_Finder03 @500mk500 @RacWatchin8872 @skocherhan @AndreGironda @Jamestwt @ViriBack @malwrhunterteam Related #BTMob samples
👇
https://t.co/67fUa7OenY
103.106.66[.147:]8080
@500mk500
@RacWatchin8872
@skocherhan
@AndreGironda
@Jamestwt
@ViriBack
@malwrhunterteam
#BTMob #ScreenReader #C2 #ControlPanel #ThreatIntel #CTI #BlueTeam
Strictly for defensive purpose
![Fact_Finder03's tweet photo. 103.106.66[.147:]8080
@500mk500
@RacWatchin8872
@skocherhan
@AndreGironda
@Jamestwt
@ViriBack
@malwrhunterteam
#BTMob #ScreenReader #C2 #ControlPanel #ThreatIntel #CTI #BlueTeam
Strictly for defensive purpose https://t.co/84Dy0xF6Qa](https://pbs.twimg.com/media/HOEZaNGbMAAdrfW.png)
#BTMOB C2 Panel
URL: xyzzxyz[.]xyz
#C2Panel #C2 #ControlPanel #android #malware
Strictly for defensive purpose
![Malwarehunterr's tweet photo. #BTMOB C2 Panel
URL: xyzzxyz[.]xyz
#C2Panel #C2 #ControlPanel #android #malware
Strictly for defensive purpose](https://pbs.twimg.com/media/HM7-z4uaUAAO1SJ.jpg)
@Fact_Finder03 @RacWatchin8872 @skocherhan @AndreGironda @JAMESWT_WT @ViriBack @malwrhunterteam It is related to #BTMOB Android bankbot malware
New #IOC related to #BTMOB #RAT
102.220.88[.]4[:]88
btmob-rat[.]com
64.89.161[.]92
ref: https://t.co/aMr1EksanG
@500mk500
@ViriBack
@skocherhan
@BlinkzSec
@JAMESWT_WT
@ESETresearch
@malwrhunterteam
#Panel #CTI #BlueTeam #AndroidMalware
Strictly for defensive purpose
![Fact_Finder03's tweet photo. New #IOC related to #BTMOB #RAT
102.220.88[.]4[:]88
btmob-rat[.]com
64.89.161[.]92
ref: https://t.co/aMr1EksanG
@500mk500
@ViriBack
@skocherhan
@BlinkzSec
@JAMESWT_WT
@ESETresearch
@malwrhunterteam
#Panel #CTI #BlueTeam #AndroidMalware
Strictly for defensive purpose https://t.co/R2TDHREFI4](https://pbs.twimg.com/media/HJdvbWgbcAA1u7P.jpg)
![Fact_Finder03's tweet photo. New #IOC related to #BTMOB #RAT
102.220.88[.]4[:]88
btmob-rat[.]com
64.89.161[.]92
ref: https://t.co/aMr1EksanG
@500mk500
@ViriBack
@skocherhan
@BlinkzSec
@JAMESWT_WT
@ESETresearch
@malwrhunterteam
#Panel #CTI #BlueTeam #AndroidMalware
Strictly for defensive purpose https://t.co/R2TDHREFI4](https://pbs.twimg.com/media/HJdvbWebsAACAky.jpg)
#ThreatProtection #BTMOB #Android RAT targets Latin America, read more about Symantec's coverage: https://t.co/nyUhfTk8oW
31.7.61[.61
BTMOB Panel
@500mk500
@ViriBack
@skocherhan
@AndreGironda
#BTMOB #RAT #panel #C2 #CTI #ThreatIntel
For defensive purposes
![Merlax_'s tweet photo. #Malware Android - Fake Google Play + #BTMOB 🇧🇷
Fake Google play
s://191.]96.]224.]87/apps_obfuscated/
s://191.]96.]225.]241/apps_criptografado/apps_obfuscated/
BTMOB
s://191.]101.]131.]250/
s://191.]96.]78.]28/
s://200.]9.]155.]153/
s://191.]96.]78.]172/
s://arbsniper.]com/ https://t.co/0IpJaU8Nau](https://pbs.twimg.com/media/G-LrARhXIAAw67T.png)
![Merlax_'s tweet photo. #Malware Android - Fake Google Play + #BTMOB 🇧🇷
Fake Google play
s://191.]96.]224.]87/apps_obfuscated/
s://191.]96.]225.]241/apps_criptografado/apps_obfuscated/
BTMOB
s://191.]101.]131.]250/
s://191.]96.]78.]28/
s://200.]9.]155.]153/
s://191.]96.]78.]172/
s://arbsniper.]com/ https://t.co/0IpJaU8Nau](https://pbs.twimg.com/media/G-LqIyQXwAAOz76.png)
![Merlax_'s tweet photo. #Malware Android - Fake Google Play + #BTMOB 🇧🇷
Fake Google play
s://191.]96.]224.]87/apps_obfuscated/
s://191.]96.]225.]241/apps_criptografado/apps_obfuscated/
BTMOB
s://191.]101.]131.]250/
s://191.]96.]78.]28/
s://200.]9.]155.]153/
s://191.]96.]78.]172/
s://arbsniper.]com/ https://t.co/0IpJaU8Nau](https://pbs.twimg.com/media/G-LqIyCXcAAJ_QI.png)
![Merlax_'s tweet photo. #Malware Android - Fake Google Play + #BTMOB 🇧🇷
Fake Google play
s://191.]96.]224.]87/apps_obfuscated/
s://191.]96.]225.]241/apps_criptografado/apps_obfuscated/
BTMOB
s://191.]101.]131.]250/
s://191.]96.]78.]28/
s://200.]9.]155.]153/
s://191.]96.]78.]172/
s://arbsniper.]com/ https://t.co/0IpJaU8Nau](https://pbs.twimg.com/media/G-Lp-AVXcAAKf7P.png)
🐀 A leak exposed the full development kit behind BTMOB RAT, revealing its dropper, builder, operator panel and C2. Built on SpySolr/Crax lineage, the platform remains actively developed.
Read: https://t.co/68hCS0OOT9
#BTMOB #RAT #AndroidMalware #SpySolr
#CybercrimeEcosystem
@ArmoredMobile
🚨 Our new TI Report outlines cross-platform threats that SOCs should track right now:
🔹 #BTMOB RAT abuses Accessibility Services to target banking apps
🔹 #PDFChampions is delivered through malvertising, a highly effective initial infection vector
🔹 #Efimer combines phishing and WordPress exploits to steal credentials
👨💻 Read the report, gather IOCs, and see how #ANYRUN helped detect and analyze these threats with deep visibility and unique threat intelligence: https://t.co/sd2YHkIYEL
🚨 New Android malware alert: GPT Trade is being spread via a fake Google Play Store!
The app drops #BTMob spyware and the #UASecurity Miner, using a APK packer to evade detection.
Full analysis 👇
https://t.co/wc5JxrX7ar
#AndroidMalware #ThreatIntel #OpenAI #ChatGPT
#Malware - #BTMob RAT apuntando a 🇦🇷
IOCs:
hxxp://45.61.139.108/
hxxp://212.224.88.213/
Estructura de archivos en la img >
🚩 Interesante portal https://aflp-gob-ar[.]com/ (indexado en buscadores) suplanta a la Agencia de Recaudación y Control Aduanero (ARCA) del Gobierno de Argentina 🇦🇷
Sitio web descarga App maliciosa (malware) desde https://aflp-gob-ar[.]com/landing/fetch_satt.php (OJO, podría estar relacionado a los operadores de esta otra campaña en México: https://t.co/UzOoto0BjA).
[+] Sample: https://t.co/y757lrWDze
/ @Merlax_
![1ZRR4H's tweet photo. 🚩 Interesante portal https://aflp-gob-ar[.]com/ (indexado en buscadores) suplanta a la Agencia de Recaudación y Control Aduanero (ARCA) del Gobierno de Argentina 🇦🇷
Sitio web descarga App maliciosa (malware) desde https://aflp-gob-ar[.]com/landing/fetch_satt.php (OJO, podría estar relacionado a los operadores de esta otra campaña en México: https://t.co/UzOoto0BjA).
[+] Sample: https://t.co/y757lrWDze
/ @Merlax_](https://pbs.twimg.com/media/Gyz-U3SW8AA-j-O.jpg)
![1ZRR4H's tweet photo. 🚩 Interesante portal https://aflp-gob-ar[.]com/ (indexado en buscadores) suplanta a la Agencia de Recaudación y Control Aduanero (ARCA) del Gobierno de Argentina 🇦🇷
Sitio web descarga App maliciosa (malware) desde https://aflp-gob-ar[.]com/landing/fetch_satt.php (OJO, podría estar relacionado a los operadores de esta otra campaña en México: https://t.co/UzOoto0BjA).
[+] Sample: https://t.co/y757lrWDze
/ @Merlax_](https://pbs.twimg.com/media/Gyz7S49WYAAtQzF.jpg)
![1ZRR4H's tweet photo. 🚩 Interesante portal https://aflp-gob-ar[.]com/ (indexado en buscadores) suplanta a la Agencia de Recaudación y Control Aduanero (ARCA) del Gobierno de Argentina 🇦🇷
Sitio web descarga App maliciosa (malware) desde https://aflp-gob-ar[.]com/landing/fetch_satt.php (OJO, podría estar relacionado a los operadores de esta otra campaña en México: https://t.co/UzOoto0BjA).
[+] Sample: https://t.co/y757lrWDze
/ @Merlax_](https://pbs.twimg.com/media/Gyz7S4gWoAAQ2Tm.jpg)
#BTMOB Android RAT Websocket Network Traffic
Article -> https://t.co/PMOjImhNQA
Sbx -> https://t.co/p47zQBETne
![Merlax_'s tweet photo. #Malware #Android posible BTMOB apuntando a 🇧🇷🎯
Sites
hxxps://191.96.79.133/Transporte%20Seguro/
hxxps://191.96.79.133/Magalu%20Entregas/
IOCs
hxxp//195.]160.]221.]203/yaarsa/private/yarsap_80541.]php
ws
195.]160.]221.]203:8080
VT
https://t.co/IRCuukxZ5F https://t.co/gHsOaX7ZFf](https://pbs.twimg.com/media/GrWNYSTWgAA6uj0.png)
![Merlax_'s tweet photo. #Malware #Android posible BTMOB apuntando a 🇧🇷🎯
Sites
hxxps://191.96.79.133/Transporte%20Seguro/
hxxps://191.96.79.133/Magalu%20Entregas/
IOCs
hxxp//195.]160.]221.]203/yaarsa/private/yarsap_80541.]php
ws
195.]160.]221.]203:8080
VT
https://t.co/IRCuukxZ5F https://t.co/gHsOaX7ZFf](https://pbs.twimg.com/media/GrWNKJfXYAAkSJK.png)
![Merlax_'s tweet photo. #Malware #Android posible BTMOB apuntando a 🇧🇷🎯
Sites
hxxps://191.96.79.133/Transporte%20Seguro/
hxxps://191.96.79.133/Magalu%20Entregas/
IOCs
hxxp//195.]160.]221.]203/yaarsa/private/yarsap_80541.]php
ws
195.]160.]221.]203:8080
VT
https://t.co/IRCuukxZ5F https://t.co/gHsOaX7ZFf](https://pbs.twimg.com/media/GrWModJW8AAXMx7.jpg)
@alberto__segura C2 communication for these samples is similar to #Btmob #rat - https://t.co/N6RTewVlry
example - https://t.co/LDYgYkPsg5
@Tim45434590 @Trouble141 @Fermentedmust @cguthier @BBCNews @theipaper So many lies from the #BTMob , its a real awakening 4 most folk ,
Most Popular Users
Elon Musk 
@elonmusk
241.5M followers
Barack Obama
@barackobama
119.1M followers
Cristiano Ronaldo
@cristiano
113.5M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.2M followers
Rihanna
@rihanna
98.5M followers
NASA
@nasa
92.3M followers
Justin Bieber
@justinbieber
91.7M followers
KATY PERRY
@katyperry
89.5M followers
Taylor Swift
@taylorswift13
83.4M followers
Lady Gaga
@ladygaga
74.9M followers
Virat Kohli
@imvkohli
72.6M followers
Kim Kardashian
@kimkardashian
70.7M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
65.5M followers
Bill Gates
@billgates
64.8M followers
Selena Gomez
@selenagomez
62.5M followers
The Ellen Show
@theellenshow
62.3M followers
CNN
@cnn
61.8M followers
X
@x
60.8M followers