Inside the Underground Business of BTMOB RAT

BTMOB is an Android remote access trojan (RAT) offered as malware-as-a-service (MaaS), enabling attackers to steal data and remotely control infected devices. Initially operated as a centralized service, BTMOB's ecosystem has fragmented after the original operator sold the full source code in 2025, leading to independent resellers, counterfeit versions, and impersonators. The official operation continues to release new versions and sell access, private infrastructure, and source code, while cheaper alternatives have emerged on Telegram and underground forums, creating a decentralized and untrustworthy marketplace. This proliferation complicates attribution and increases the risk of scams and unstable or malicious variants.

AI-extracted · verify before operational use