Top Tweets for #Btmob
🚨 BTMOB turns Android phishing into no‑code device takeover— abusing Accessibility to hijack screens, steal credentials, and bypass 2FA.
🌐 https://t.co/jBIbsMeNqc
#AndroidSecurity #PhishingAlert #BTMOB #CyberThreat
Try it for FREE. 🆓
@James_inthe_box @Fact_Finder03 @500mk500 @RacWatchin8872 @skocherhan @AndreGironda @Jamestwt @ViriBack @malwrhunterteam Related #BTMob samples
👇
https://t.co/67fUa7OenY
103.106.66[.147:]8080
@500mk500
@RacWatchin8872
@skocherhan
@AndreGironda
@Jamestwt
@ViriBack
@malwrhunterteam
#BTMob #ScreenReader #C2 #ControlPanel #ThreatIntel #CTI #BlueTeam
Strictly for defensive purpose
![Fact_Finder03's tweet photo. 103.106.66[.147:]8080
@500mk500
@RacWatchin8872
@skocherhan
@AndreGironda
@Jamestwt
@ViriBack
@malwrhunterteam
#BTMob #ScreenReader #C2 #ControlPanel #ThreatIntel #CTI #BlueTeam
Strictly for defensive purpose https://t.co/84Dy0xF6Qa](https://pbs.twimg.com/media/HOEZaNGbMAAdrfW.png)
New #IOC related to #BTMOB #RAT
102.220.88[.]4[:]88
btmob-rat[.]com
64.89.161[.]92
ref: https://t.co/aMr1EksanG
@500mk500
@ViriBack
@skocherhan
@BlinkzSec
@JAMESWT_WT
@ESETresearch
@malwrhunterteam
#Panel #CTI #BlueTeam #AndroidMalware
Strictly for defensive purpose
![Fact_Finder03's tweet photo. New #IOC related to #BTMOB #RAT
102.220.88[.]4[:]88
btmob-rat[.]com
64.89.161[.]92
ref: https://t.co/aMr1EksanG
@500mk500
@ViriBack
@skocherhan
@BlinkzSec
@JAMESWT_WT
@ESETresearch
@malwrhunterteam
#Panel #CTI #BlueTeam #AndroidMalware
Strictly for defensive purpose https://t.co/R2TDHREFI4](https://pbs.twimg.com/media/HJdvbWgbcAA1u7P.jpg)
![Fact_Finder03's tweet photo. New #IOC related to #BTMOB #RAT
102.220.88[.]4[:]88
btmob-rat[.]com
64.89.161[.]92
ref: https://t.co/aMr1EksanG
@500mk500
@ViriBack
@skocherhan
@BlinkzSec
@JAMESWT_WT
@ESETresearch
@malwrhunterteam
#Panel #CTI #BlueTeam #AndroidMalware
Strictly for defensive purpose https://t.co/R2TDHREFI4](https://pbs.twimg.com/media/HJdvbWebsAACAky.jpg)
#ThreatProtection #BTMOB #Android RAT targets Latin America, read more about Symantec's coverage: https://t.co/nyUhfTk8oW
31.7.61[.61
BTMOB Panel
@500mk500
@ViriBack
@skocherhan
@AndreGironda
#BTMOB #RAT #panel #C2 #CTI #ThreatIntel
For defensive purposes
![Merlax_'s tweet photo. #Malware Android - Fake Google Play + #BTMOB 🇧🇷
Fake Google play
s://191.]96.]224.]87/apps_obfuscated/
s://191.]96.]225.]241/apps_criptografado/apps_obfuscated/
BTMOB
s://191.]101.]131.]250/
s://191.]96.]78.]28/
s://200.]9.]155.]153/
s://191.]96.]78.]172/
s://arbsniper.]com/ https://t.co/0IpJaU8Nau](https://pbs.twimg.com/media/G-LrARhXIAAw67T.png)
![Merlax_'s tweet photo. #Malware Android - Fake Google Play + #BTMOB 🇧🇷
Fake Google play
s://191.]96.]224.]87/apps_obfuscated/
s://191.]96.]225.]241/apps_criptografado/apps_obfuscated/
BTMOB
s://191.]101.]131.]250/
s://191.]96.]78.]28/
s://200.]9.]155.]153/
s://191.]96.]78.]172/
s://arbsniper.]com/ https://t.co/0IpJaU8Nau](https://pbs.twimg.com/media/G-LqIyQXwAAOz76.png)
![Merlax_'s tweet photo. #Malware Android - Fake Google Play + #BTMOB 🇧🇷
Fake Google play
s://191.]96.]224.]87/apps_obfuscated/
s://191.]96.]225.]241/apps_criptografado/apps_obfuscated/
BTMOB
s://191.]101.]131.]250/
s://191.]96.]78.]28/
s://200.]9.]155.]153/
s://191.]96.]78.]172/
s://arbsniper.]com/ https://t.co/0IpJaU8Nau](https://pbs.twimg.com/media/G-LqIyCXcAAJ_QI.png)
![Merlax_'s tweet photo. #Malware Android - Fake Google Play + #BTMOB 🇧🇷
Fake Google play
s://191.]96.]224.]87/apps_obfuscated/
s://191.]96.]225.]241/apps_criptografado/apps_obfuscated/
BTMOB
s://191.]101.]131.]250/
s://191.]96.]78.]28/
s://200.]9.]155.]153/
s://191.]96.]78.]172/
s://arbsniper.]com/ https://t.co/0IpJaU8Nau](https://pbs.twimg.com/media/G-Lp-AVXcAAKf7P.png)
🐀 A leak exposed the full development kit behind BTMOB RAT, revealing its dropper, builder, operator panel and C2. Built on SpySolr/Crax lineage, the platform remains actively developed.
Read: https://t.co/68hCS0OOT9
#BTMOB #RAT #AndroidMalware #SpySolr
#CybercrimeEcosystem
@ArmoredMobile
🚨 Our new TI Report outlines cross-platform threats that SOCs should track right now:
🔹 #BTMOB RAT abuses Accessibility Services to target banking apps
🔹 #PDFChampions is delivered through malvertising, a highly effective initial infection vector
🔹 #Efimer combines phishing and WordPress exploits to steal credentials
👨💻 Read the report, gather IOCs, and see how #ANYRUN helped detect and analyze these threats with deep visibility and unique threat intelligence: https://t.co/sd2YHkIYEL
🚨 New Android malware alert: GPT Trade is being spread via a fake Google Play Store!
The app drops #BTMob spyware and the #UASecurity Miner, using a APK packer to evade detection.
Full analysis 👇
https://t.co/wc5JxrX7ar
#AndroidMalware #ThreatIntel #OpenAI #ChatGPT
#Malware - #BTMob RAT apuntando a 🇦🇷
IOCs:
hxxp://45.61.139.108/
hxxp://212.224.88.213/
Estructura de archivos en la img >
🚩 Interesante portal https://aflp-gob-ar[.]com/ (indexado en buscadores) suplanta a la Agencia de Recaudación y Control Aduanero (ARCA) del Gobierno de Argentina 🇦🇷
Sitio web descarga App maliciosa (malware) desde https://aflp-gob-ar[.]com/landing/fetch_satt.php (OJO, podría estar relacionado a los operadores de esta otra campaña en México: https://t.co/UzOoto0BjA).
[+] Sample: https://t.co/y757lrWDze
/ @Merlax_
![1ZRR4H's tweet photo. 🚩 Interesante portal https://aflp-gob-ar[.]com/ (indexado en buscadores) suplanta a la Agencia de Recaudación y Control Aduanero (ARCA) del Gobierno de Argentina 🇦🇷
Sitio web descarga App maliciosa (malware) desde https://aflp-gob-ar[.]com/landing/fetch_satt.php (OJO, podría estar relacionado a los operadores de esta otra campaña en México: https://t.co/UzOoto0BjA).
[+] Sample: https://t.co/y757lrWDze
/ @Merlax_](https://pbs.twimg.com/media/Gyz-U3SW8AA-j-O.jpg)
![1ZRR4H's tweet photo. 🚩 Interesante portal https://aflp-gob-ar[.]com/ (indexado en buscadores) suplanta a la Agencia de Recaudación y Control Aduanero (ARCA) del Gobierno de Argentina 🇦🇷
Sitio web descarga App maliciosa (malware) desde https://aflp-gob-ar[.]com/landing/fetch_satt.php (OJO, podría estar relacionado a los operadores de esta otra campaña en México: https://t.co/UzOoto0BjA).
[+] Sample: https://t.co/y757lrWDze
/ @Merlax_](https://pbs.twimg.com/media/Gyz7S49WYAAtQzF.jpg)
![1ZRR4H's tweet photo. 🚩 Interesante portal https://aflp-gob-ar[.]com/ (indexado en buscadores) suplanta a la Agencia de Recaudación y Control Aduanero (ARCA) del Gobierno de Argentina 🇦🇷
Sitio web descarga App maliciosa (malware) desde https://aflp-gob-ar[.]com/landing/fetch_satt.php (OJO, podría estar relacionado a los operadores de esta otra campaña en México: https://t.co/UzOoto0BjA).
[+] Sample: https://t.co/y757lrWDze
/ @Merlax_](https://pbs.twimg.com/media/Gyz7S4gWoAAQ2Tm.jpg)
#BTMOB Android RAT Websocket Network Traffic
Article -> https://t.co/PMOjImhNQA
Sbx -> https://t.co/p47zQBETne
![Merlax_'s tweet photo. #Malware #Android posible BTMOB apuntando a 🇧🇷🎯
Sites
hxxps://191.96.79.133/Transporte%20Seguro/
hxxps://191.96.79.133/Magalu%20Entregas/
IOCs
hxxp//195.]160.]221.]203/yaarsa/private/yarsap_80541.]php
ws
195.]160.]221.]203:8080
VT
https://t.co/IRCuukxZ5F https://t.co/gHsOaX7ZFf](https://pbs.twimg.com/media/GrWNYSTWgAA6uj0.png)
![Merlax_'s tweet photo. #Malware #Android posible BTMOB apuntando a 🇧🇷🎯
Sites
hxxps://191.96.79.133/Transporte%20Seguro/
hxxps://191.96.79.133/Magalu%20Entregas/
IOCs
hxxp//195.]160.]221.]203/yaarsa/private/yarsap_80541.]php
ws
195.]160.]221.]203:8080
VT
https://t.co/IRCuukxZ5F https://t.co/gHsOaX7ZFf](https://pbs.twimg.com/media/GrWNKJfXYAAkSJK.png)
![Merlax_'s tweet photo. #Malware #Android posible BTMOB apuntando a 🇧🇷🎯
Sites
hxxps://191.96.79.133/Transporte%20Seguro/
hxxps://191.96.79.133/Magalu%20Entregas/
IOCs
hxxp//195.]160.]221.]203/yaarsa/private/yarsap_80541.]php
ws
195.]160.]221.]203:8080
VT
https://t.co/IRCuukxZ5F https://t.co/gHsOaX7ZFf](https://pbs.twimg.com/media/GrWModJW8AAXMx7.jpg)
@alberto__segura C2 communication for these samples is similar to #Btmob #rat - https://t.co/N6RTewVlry
example - https://t.co/LDYgYkPsg5
@Tim45434590 @Trouble141 @Fermentedmust @cguthier @BBCNews @theipaper So many lies from the #BTMob , its a real awakening 4 most folk ,
Last Seen Hashtags on Sotwe
manto_mujhmenzindahhai
Seen from United States
zelal
Seen from Turkey
BusinesSchool
Seen from United States
Tony_Leung
Seen from United States
pawg #chudai #wataa
Seen from Brazil
dtritus
Seen from United States
ซับไทย
Seen from Thailand
gay colbar
Seen from United States
rekaxingtime
Seen from United States
学習者エンゲージメント
Seen from United States
Trends for you
Most Popular Users
Elon Musk 
@elonmusk
241.5M followers
Barack Obama
@barackobama
119.1M followers
Cristiano Ronaldo
@cristiano
113.5M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.2M followers
Rihanna
@rihanna
98.5M followers
NASA
@nasa
92.3M followers
Justin Bieber
@justinbieber
91.7M followers
KATY PERRY
@katyperry
89.5M followers
Taylor Swift
@taylorswift13
83.4M followers
Lady Gaga
@ladygaga
74.9M followers
Virat Kohli
@imvkohli
72.5M followers
Kim Kardashian
@kimkardashian
70.7M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
65.5M followers
Bill Gates
@billgates
64.8M followers
Selena Gomez
@selenagomez
62.5M followers
The Ellen Show
@theellenshow
62.3M followers
CNN
@cnn
61.8M followers
X
@x
60.8M followers