BTMOB Android Remote Access Trojan Distributed via No-Code Builder Tool (welivesecurity.com)

• BTMOB is sold with a no-code APK builder enabling rapid payload generation.
• Delivered via phishing sites and fake app stores, abusing Accessibility Services.
• Initially detected in Brazil, marketed globally via Telegram and social media.

"ESET researchers identified BTMOB, an Android RAT evolved from SpySolr, sold as a malware-as-a-service with a no-code APK builder. Delivered through phishing sites and fake app stores, it abuses Accessibility Services to seize device control. The malware targets Brazil initially but is marketed globally via Telegram and social media. A $5,000 lifetime license enables rapid payload generation. ESET detects it as MSIL/BtmobRat and variants."