Balonx Sistema PhaaS Targets 20+ Mexican Banks With AI Vishing and Android RAT

Balonx Sistema is a subscription-based Phishing-as-a-Service platform targeting Mexican banks that combines real-time interactive phishing pages, a Spyroid-based Android RAT (package name sacred.explosion) with C2 at 196.251.84.11:7771, rapid domain rotation, a PostgreSQL backend for persistence, and AI-powered vishing (GPT-4o-mini, ElevenLabs/OpenAI voices, Whisper). The service has reportedly harvested credentials and financial data from over 1,100 victims, is marketed via social platforms, and offers tiered affiliate plans enabling large-scale, automated banking fraud.