GXC Team Unmasked: The cybercriminal group targeting Spanish bank users with AI-powered phishing tools and Android malware

GXC Team is a Spanish-speaking criminal group running a phishing-as-a-service operation that targets Spanish banking customers by combining phishing kits, an Android SMS OTP stealer (which forces itself to be the default SMS app and forwards OTPs to a Telegram bot), and AI-driven voice-caller scams; Group-IB identified ~250 phishing domains, 9 malware variants, and that the service targets 36 Spanish banks and other institutions, posing a significant regional banking fraud threat.