Why the $700‑per‑month Android RAT Is Flooding the Underground Market
Security firm Flare’s analysis of thousands of forum posts reveals that the BTMOB Android remote‑access trojan, originally priced at $700 per month, has evolved from a single‑operator service into a fragmented ecosystem of resale, source‑code sales, and counterfeit versions, with secondary‑market prices up to 13‑times lower than the official rates.
What Is BTMOB?
BTMOB is an Android remote‑access trojan (RAT) sold as Malware‑as‑a‑Service (MaaS). It bundles a dropper, payload builder, Windows control panel, server infrastructure, and tools for phishing and credential theft, allowing attackers to create malicious Android apps without building anything from scratch.
Distribution Methods
Attackers spread BTMOB mainly through social‑engineering: victims are lured to phishing sites masquerading as streaming services, crypto‑mining platforms, fake WhatsApp MODs, or government portals, then directed to install a malicious APK from counterfeit app stores. After installation, BTMOB requests Android Accessibility Services permission to gain elevated system rights and persist on the device. Researchers also observed region‑specific lures, such as fake Argentine tax and customs agencies.
Official Pricing and Operational History
Initial Offering (Jan 2025)
Monthly subscription: $700/month
Lifetime license: $3,000
Private infrastructure + support: $5,000+ per month
Within a month the operators reported server errors and claimed over 4,000 devices were connected, but could not confirm whether traffic stemmed from legitimate customers or DDoS attacks.
Source‑Code Sale (May 2025)
The official channel sold the full BTMOB source code and deployment guide for $20,000, including PHP/Node.js server components, a VB.NET control panel, and Android Java code. The sellers argued that source‑code sales generated profit, allowed customers to audit the code, and supported custom or alternative versions without halting development.
At the same time a split emerged: a Spanish‑ and Portuguese‑speaking support channel temporarily shut down its servers amid a dispute between two administrators.
Administrator Split (Jul 2025)
One administrator in Brazil purchased the source code and began operating an independent version. The advertised price for the source code fell to $10,000.
Continued Updates (2026)
Feb 2026: Release V4.1
Apr 2026: Release V4.5 with additional server nodes and a central management page
V4.5 pricing:
Lifetime account: $1,200
Private server multi‑account: $3,000
Server source code: $7,000
Rapid Rise of the Secondary Market
While the official operation continued, a secondary market quickly emerged offering much lower prices.
Coordinated Telegram Promotion
A coordinated Telegram campaign advertised a lifetime license for $1,500 and directed buyers to contact @thebtmobadmin and @btmobportal. The same wording, price, and contacts were repeated across multiple groups.
Lower‑Priced Competitors
Other vendors advertised weekly, monthly, and lifetime plans, sometimes claiming to include source code. Some offered cheap user or admin panel accounts for resale. Numerous sites posted nearly identical source‑code and panel ads, often linking to the same contacts. Free trials and $800 lifetime licenses with custom branding were also advertised.
Official Denial (Apr 2026)
The official BTMOB channel issued a statement on 26 April 2026 claiming it was the sole legitimate channel and disavowing responsibility for other accounts, though the timing does not prove the statement addressed the specific sellers.
Price Comparison
Official lifetime license: $3,000
Secondary‑market lifetime license: $800 (up to 6× cheaper)
Official source code: $20,000
Secondary‑market source code: $1,500 (up to 13× cheaper)
From a Single Service to a Fragmented Market
The BTMOB case illustrates a common pattern: once a successful product’s “recipe” is sold, other actors can replicate it without bearing the original development costs. Cheap copies proliferate, varying in quality—some improve on the original, others are unstable, poorly supported, or outright scams.
Security researchers note that the ecosystem has shifted from a mature MaaS operation to a hybrid of independently managed versions, cheap clones, competing sales channels, and indistinguishable genuine versus counterfeit offerings.
Key conclusion: The name BTMOB no longer denotes a single operator, infrastructure, or service level. Buyers must evaluate not only the software but also the seller’s reputation, support capabilities, and evidence of service effectiveness.
Defensive Recommendations
Use official app stores only: Attackers rely on fake app stores masquerading as Google Play; organizations should enforce downloads from trusted repositories.
Beware of suspicious links: Treat unsolicited links in email, messaging apps, social media, and targeted ads with suspicion.
Deploy mobile security solutions: Apply the same security posture to mobile devices as to other endpoints.
Conduct security awareness training: Educate employees that a single rogue download can expose critical corporate data.
Image sources: BleepingComputer, Flare, WeLiveSecurity, Twitter/@Merlax_, @johnk3r, Germán Fernández Bacian.
Signed-in readers can open the original source through BestHub's protected redirect.
This article has been distilled and summarized from source material, then republished for learning and reference. If you believe it infringes your rights, please contactand we will review it promptly.
Black & White Path
We are the beacon of the cyber world, a stepping stone on the road to security.
How this landed with the community
Was this worth your time?
0 Comments
Thoughtful readers leave field notes, pushback, and hard-won operational detail here.