Introduction

Mexico’s banking infrastructure has emerged as a primary target for sophisticated cyber threats in Latin America, ranking second only to Brazil in banking malware incidents in 2025. This escalation is tightly linked to the rise of Phishing-as-a-Service (PhaaS) platforms, which enable low-capability threat actors to execute industrial-scale financial fraud. More than 20 financial institutions in the country currently face these persistent, subscription-based operational threats.

In response to this threat landscape, Group-IB conducted an in-depth technical analysis of Balonx Sistema, a highly structured PhaaS platform developed by an operative based in Mexico. Moving beyond traditional static phishing kits, Balonx functions as a comprehensive cybercriminal enterprise featuring tiered subscriptions, live WebSocket victim interaction, an integrated Android Remote Access Trojan (RAT), and an advanced AI-driven vishing component that automates voice fraud via synthetic speech and LLMs.

The platform was observed to be promoted openly on Facebook groups popular among telemarketing fraud circles. A critical operational security failure through leaked GitHub repositories provided Group-IB researchers with visibility into the PhaaS operations. This allowed analysts to track victims, inspect the infrastructure, and map out the entire domain and affiliate network.

The analysis in this blog aims to provide actionable threat intelligence to defenders, financial institutions, and security personnel working to mitigate similar risks across Latin America.

Key Discoveries

• Subscription-based Model: Balonx Sistema operates a weekly subscription PhaaS targeting over 20 financial organizations in Mexico.
• 1100+ Users credentials and financial information have been harvested since at least October, 2025.
• Real-time Session Hijacking: Threat actors leverage persistent WebSocket sessions to dynamically push 14 unique fraudulent screens onto victim devices.
• Active domain rotation is a core persistence mechanism.
• Balonx bundles a commercial Android RAT based on Spyroid as part of its kit.
• A parallel AI vishing module named CallFlow automates outbound telephony fraud using different AI solutions designed to replace human operators entirely.

Who may find this blog interesting

• Cybersecurity analysts and corporate security teams
• Malware analysts
• Threat intelligence specialists
• Cyber investigators
• Computer Emergency Response Teams (CERT)
• Law enforcement investigators
• Cyber police forces

Group-IB Threat Intelligence Portal:

Group-IB customers can access our Threat Intelligence portal for more information about Balonx Sistema and related PhaaS infrastructure:

• Balonx Sistema.
• BankProtect

The Balonx Business Model: Criminal SaaS for the Mexican Market

Balonx Sistema operates with a level of commercial sophistication that mirrors legitimate software-as-a-service companies. Rather than selling phishing kits as one-off purchases on dark web marketplaces, the operator rents operational access on a weekly basis, creating a recurring revenue stream while maintaining centralized control over the infrastructure.

New affiliates register through a Telegram bot linked to the PhaaS panel’s login page. Upon submitting a registration request, the bot generates a unique identifier that serves as the affiliate’s primary key within the platform. This registration requires explicit approval from the SuperAdmin, identified in the source code and panel as ‘balonx’, maintaining a gatekeeping layer that filters out undesirable or unreliable affiliates and creates a degree of operational security for the operator.

Two subscription tiers are available. The Individual Plan, priced at 3,000 MXN per week, allows access for up to two devices and is designed for solo operators running targeted campaigns. The Office Plan at 6,000 MXN per week supports an organizational hierarchy with up to eight Executive sub-accounts, each of which can operate victim sessions independently, but with restricted panel access. Executives authenticate via one-time passwords sent through Telegram, the owning Admin controls which financial institutions each Executive may target through an ‘allowedBanks’ permission matrix.

Figure 1. Landing page of the Balonx Sistema PhaaS kit, showing its multi-bank target selection portal.

Payment processing is automated through integration with the Bitso API, a Mexican cryptocurrency exchange, enabling fully automated subscription verification without manual intervention. A discount code system (discount_codes table) provides promotional flexibility for affiliate recruitment. The platform’s hardcoded reference date of 4 October 2025 marks the kit’s commercial launch, though development activity in an observed GitHub repository traces back to June 2025.

The Balonx Sistema criminal infrastructure is observed to be advertised openly across Facebook community groups operating under names such as “Base de Datos” and “Bases de datos Negocios Serios”. These groups serve as illicit hubs for trading exfiltrated data and recruiting telemarketing operatives. Balonx is promoted through explicit posts directing interested parties to Telegram, as well as through short video demonstrations posted to public profiles that showcase the kit’s real-time control capabilities. Some of these advertising accounts show characteristics of either sock-puppet profiles managed by the SuperAdmin or reseller affiliates using a standardized tutorial video.

Attack Mechanics: Real-Time Phishing and WebSocket Session Control

Upon discovering these landing pages, Group-IB immediately identified potential issues and initiated a thorough investigation into their underlying structure. This analysis revealed the JavaScript files that load to the backend, providing valuable insights such as the path to the admin login page, Telegram accounts and bots used for registration, and the functioning of the PhaaS.

Figure 7. Extract of core JavaScript file of Balonx Sistema PhaaS establishing the WebSocket connection.

The core technical capability of Balonx Sistema is its real-time session control architecture, which fundamentally differentiates it from static phishing kits that simply harvest credentials via a form submission. Balonx uses a persistent WebSocket connection (endpoint: /ws) to maintain a live bi-directional channel between the phishing page displayed on the victim’s device and the operator’s control panel. This architecture enables the operator to function as a live man-in-the-middle: observing what the victims sees, intercepting what they submit, and dynamically modifying their screen in real time.

This WebSocket model is purpose-built to defeat multi-factor authentication. When a victim enters their banking credentials on the phishing page, the operator can immediately relay them to the legitimate banking portal, receive the MFA challenge (SMS OTP, transaction code, or withdrawal authorization), and instantly push a CODIGO or SMS_COMPRA screen to the victim requesting the same code before it expires. The victim, believing they are completing a legitimate bank verification step, submits the OTP directly to the attacker.

The SCREEN_CHANGE protocol exposes 14 distinct screen types the operator can push to the victim at any point in the session:

Table 1. Protocols of the PhaaS.

Android RAT: Bankprotect APK and Spyroid-Based Persistent Control

Balonx Sistema extends its attack surface beyond the browser into the victim’s Android device through the distribution of a malicious APK identified during forensic analysis. The download path for this file was found to be publicly accessible from the phishing infrastructure, and the application was subjected to full decompilation using JADX.

The malicious application carries the package name sacred.explosion with a main class of bxelllolzxqfmaszk1049. Technical analysis confirms it is a commercial Android RAT built on the Spyroid framework (Spyroid.net). Spyroid is a sophisticated RAT-as-a-service tool sold to cybercriminals, offering capabilities including keylogging, screen capture, file management, social media account interception, and full device remote control. The Balonx deployment incorporates Base64-encoded, obfuscated configuration fields to conceal its C2 coordinates from static analysis.

Three critical fields are hardcoded in the APK:

Table 2. Information obtained from the APK RAT.

Upon installation, the victim’s device establishes a persistent TCP connection to the C2 using setSoTimeout(0), meaning the socket never times out and the attacker maintains continuous, uninterrupted access to the compromised device. All captured data, including real-time screen content, keystrokes, SMS messages, and banking app interactions, is exfiltrated to the C2 in real time.

Figure 10. C2 IP direction in the code of the APK.

Figure 11. Socket connection establishing the Reverse Shell.

Critically, the APK is distributed through the phishing page itself via the PROTECCION_BANCARIA screen type. When the operator detects that a target has a mobile banking app installed, they push this screen, which presents a convincing fake bank security alert urging the victim to install what appears to be a bank protection application. The social engineering pretext exploits the very security awareness it claims to address, turning defensive instincts into an attack vector.

CallFlow: Vishing-AI-as-a-Service

Perhaps the most significant finding in the Balonx investigation is the discovery of a parallel, fully independent product module designated CallFlow, accessible via the domain callbalonx[.]info. This module represents a fundamental evolution in PhaaS architecture: the elimination of human call-center operators in favor of a fully automated AI-driven vishing system.

The discovery originated from technical investigation of the domain callbalonx[.]info, which presents a login interface for the CallFlow service. The underlying infrastructure was substantially clarified through the identification of an associated GitHub repository, which confirmed that CallFlow is an active development project within the broader Balonx product suite and provided detailed insight into its technical specifications.

Generative AI Stack

The CallFlow module integrates four commercial AI services into a unified telephony fraud pipeline:

Table 3. AI technologies used by CallFlow.

The underlying PBX framework is FreePBX versions 17.0.4.31 and 17.0.28, operating on a proprietary SIP server at 85.31.235[.]109 on port 5160/TCP (port 5060 is noted as unavailable in the source code comments). The platform supports 30 concurrent SIP channels by default with multi-trunk and multi-campaign configurations, enabling large-scale simultaneous outbound calling operations.

Operational Capabilities

When CallFlow contacts a victim, the conversation is conducted entirely by the LLM speaking through the synthetic voice of a fabricated bank representative named Carolina (the ElevenLabs voice profile). The victim’s spoken responses are transcribed in real time by OpenAI Whisper, which feeds the transcript back to GPT-4o-mini to generate contextually appropriate follow-up responses. The interaction is indistinguishable from a human call-center operator to most victims.

The administrative interface of the CallFlow panel displays an operational dashboard showing active calls, daily call volume, success rates, calls in queue, active campaigns, total phone records in the database, and average call duration. Investigation of the panel revealed targeted campaigns for several banks alongside a database of telephone numbers specifically related to one bank brand account, suggesting this database serves as a primary call list for the automated vishing system.

The administrative hierarchy mirrors the main PhaaS platform: Admin, Manager, and Executive roles, with managers able to covertly listen to active calls in real time using Asterisk ChanSpy. Operator Telegram contact numbers are embedded in the manager accounts, facilitating coordination between the vishing and web phishing modules.

Balonx Sistema Admin Panel Overview

The administrative panels, as illustrated below, provide a comprehensive suite for managing all Phishing-as-a-Service (PhaaS) operations. These interfaces empower standard users to generate customized phishing URLs, while granting administrators complete oversight and management capabilities for both users and fraudulent pages.

One of the key functions of this system is that all activities are centralized within a single domain. When a new session or “folio” is created, the phishing activity is hosted within the same domain. For instance, if the domain is “phishing-domain[.]xyz” and the scammer creates a folio named “12345”, the path to the phishing page would be “hxxps://phishing-domain[.]xyz/12345”. This eliminates the need to rely on other services.

Domain Infrastructure and Rotation Strategy

Balonx Sistema does not rely on a single persistent domain. The operational model uses continuous domain rotation to maintain campaign continuity as individual domains are detected, reported, and decommissioned. When a domain is taken down, the threat actor registers a new one, migrates the central database, and continues operations without loss of victim data or affiliate sessions.

This rotation strategy is enabled by a centralized backend architecture: all domains connect to the same Neon – PostgreSQL database server, meaning that victim credentials, active sessions, and affiliate accounts persist across domain changes. It has been established that the most recent registered domain contained data identical to that of its predecessors, including active users, session histories, and affiliate registrations. At the time of writing this blog, Group-IB has identified over 350 domains that we have high confidence belong to the “Aclaraciones Banciaras” and Balonx campaigns. The first domain was recorded in 2019, indicating that this campaign has been ongoing for a considerable period.

Conclusion

The Balonx Sistema investigation exposes a PhaaS operation that has moved well beyond the capabilities typically associated with regionally-focused cybercrime groups. What began as a web-based phishing kit targeting Mexican banking users has evolved into a multi-vector platform combining real-time credential harvesting, persistent Android device compromise, and fully automated AI-driven voice fraud into a single, commercially distributed product.

The integration of GPT-4o-mini, ElevenLabs synthetic voice, and OpenAI Whisper into an automated telephony fraud system represents a meaningful inflection point for the LATAM threat landscape. Vishing attacks have historically been limited by the availability of human operators. The CallFlow module eliminates that constraint entirely, enabling a single operator to run hundreds of simultaneous fraudulent calls without any human involvement in the conversation itself. As this architecture matures and spreads through criminal networks, financial institutions will face vishing attacks of unprecedented scale and linguistic quality.

The investigation also demonstrates the continued critical value of repository forensics and secrets scanning in threat intelligence operations. The critical operational security failure of Balonx transformed what would have been an external infrastructure analysis into a comprehensive investigation, providing direct access to victim telemetry, affiliate networks, and the full operational hierarchy.

Group-IB continues to monitor Balonx Sistema infrastructure, track domain rotation activity, and support notification to affected financial institutions. The threat actor’s demonstrated reliance on rapid domain cycling and evolving service offerings indicates active, ongoing operations. Defenders should treat the identified IOCs as current indicators of live campaign infrastructure, not historical artifacts.

Recommendations

For Financial Institutions and Security Teams

• Strengthen threat intelligence by leveraging proactive watchlists for ‘Balonx’ and ‘aclaracion’ keywords, enabling you to anticipate and alert on infrastructure rotation before it targets your organization.
• Enhance digital risk monitoring through services such as Group-IB’s Digital Risk Protection platform, which detects and dismantles phishing infrastructure impersonating your brand and uses graph analysis to map associated affiliate networks.
• Deploy Managed XDR capabilities to identify advanced threats by leveraging the Managed Threat Hunting module for ‘Spyroid’ indicators (e.g., the sacred.explosion package) and abnormal WebSocket traffic patterns that evade traditional signature-based detection.
• Utilize managed threat intelligence to engage dedicated analysts in profiling the specific threat actors and malware families targeting your infrastructure, providing tailored briefings on the evolution of Balonx-related threats.
• Enhance redirect chain analysis on your email and web gateways to detect and block behavioral anomalies, such as the use of legitimate services like Google Translate or open redirects to obscure malicious destinations.
• Transition to FIDO2/Hardware authentication to protect high-value users against AitM (Adversary-in-the-Middle) WebSocket relay attacks, as hardware security keys are resistant to the interception techniques commonly used by PhaaS platforms.
• Educate customers with Group-IB Cybersecurity Education to recognize phishing indicators specific to this type of campaign: URLs hosted on github.io domains, unsolicited account cancellation or support requests, and any web form requesting card details or passwords outside of your official app or website.

For End Users and Banking Customers

• Never install an application suggested by a phone call or a banking website outside of the official mobile AppStores. Legitimate banks do not require customers to install third-party security applications.
• Verify bank calls independently: hang up and call the number on the back of your bank card. AI-generated voices are now indistinguishable from human operators in real-time telephone calls.
• Be suspicious of any website that requests your ATM PIN, card CVV, or asks you to scan your physical card with your phone camera. These are not legitimate banking verification steps.
• Enable biometric authentication and hardware security keys where available. These are significantly harder for real-time phishing infrastructure to intercept than SMS OTPs.

Acknowledgement of research support:

• Martina Lopez – Threat Intelligence Analyst
• Lucas Mancilha – Threat Intelligence Analyst

MITRE ATT&CK

Indicators of Compromise (IOCs)

Network IOCs

• More 350+ identified domains since 2019. Such as:
  • Aclaraciones-digital[.]online
  • soporte-aclaracion[.]xyz
  • balonx[.]online
• callbalonx[.]info (CallFlow AI vishing login portal)
• panelbalonxfs[.]xyz (CallFlow FreePBX backend and UCP)

• C2 IP (Android RAT): 196.251.84[.]11
• C2 Port (Android RAT): 7771/TCP
• SIP Server IP (CallFlow): 85.31.235[.]109
• SIP Port (CallFlow): 5160/TCP
• GraphQL API: panelbalonxfs[.]xyz/admin/api/api/gql
• REST API: panelbalonxfs[.]xyz/admin/api/api/rest
• Auth Token Endpoint: panelbalonxfs[.]xyz/admin/api/api/token
• WebSocket C2 path: /ws (present on all active Balonx phishing domains)

File Indicators

• APK Package Name: sacred.explosion
• APK Main Class: bxelllolzxqfmaszk1049
• APK Base64 C2 Host field: MTk2LjI1MS44NC4xMQ==
• APK Base64 C2 Port field: Nzc3MQ==
• APK Distribution: Served via PROTECCION_BANCARIA screen type as fake bank protection app

Disclaimer

DISCLAIMER: All technical information, including malware analysis, indicators of compromise and infrastructure details provided in this publication, is shared solely for defensive cybersecurity and research purposes. Group-IB does not endorse or permit any unauthorized or offensive use of the information contained herein. The data and conclusions represent Group-IB’s analytical assessment based on available evidence and are intended to help organizations detect, prevent, and respond to cyber threats.

Group-IB expressly disclaims liability for any misuse of the information provided. Organizations and readers are encouraged to apply this intelligence responsibly and in compliance with all applicable laws and regulations.

This blog may reference legitimate third-party services such as Telegram, OpenAI, ElevenLabs, Replit, and others, solely to illustrate cases where threat actors have abused or misused these platforms.

This material is provided for informational purposes, prepared by Group-IB as part of its own analytical investigation, and reflects recently identified threat activity.

All trademarks referenced herein are the property of their respective owners and are used solely for informational purposes, without any implication of affiliation or sponsorship.