From Lock Screen to Wallets: BTMOB RAT Now Targets Alipay PINs

**Executive Summary:** Zimperium zLabs analyzed a multi-version campaign of BTMOB RAT spyware (v2.5–v3.2) delivered via deceptive phishing sites and droppers impersonating legitimate apps and services; the malware abuses Android Accessibility and encrypted overlay assets to capture lock-screen credentials and Alipay PINs, performs keylogging, screen/audio capture and exfiltrates data to C2 servers, with 32 droppers and 44 payloads identified and associated MITRE ATT&CK techniques and IOCs provided.