AI-Powered Phishing Service 'Balonx Sistema' Targets Mexican Financial Institutions

Cybercriminals are employing a novel and highly effective phishing-as-a-service (PhaaS) platform, dubbed Balonx Sistema, that combines artificial intelligence-driven voice calls with convincing fake banking websites to circumvent multi-factor authentication (MFA) and compromise user accounts. This blended attack strategy allows threat actors to gain a live view of a victim's phishing session, enabling them to request sensitive information at precisely the opportune moment.

The Balonx Sistema campaign has been actively targeting over 20 financial institutions in Mexico, successfully compromising the accounts of more than 1,100 individuals since at least October 2025. The platform is structured as a subscription service, significantly lowering the barrier to entry for affiliates seeking to conduct large-scale banking scams. It offers both individual and office plans, providing multiple operators with controlled access to victim sessions and a selection of targeted banking brands.

Security researchers at Group-IB identified the platform after discovering leaked GitHub repositories that exposed elements of its infrastructure and affiliate network. According to their analysis, Balonx integrates live phishing capabilities, an Android remote access tool (RAT), and automated voice fraud. This multi-pronged approach begins with an urgent phone call, progresses to a deceptive website, and can culminate in the installation of malicious mobile software, demonstrating how even SMS-based codes are insufficient against determined attackers.

A key technical innovation of Balonx is its use of a persistent WebSocket connection. This maintains a real-time link between the phishing page and the attacker's control panel. Once a victim enters their banking credentials, the operator can relay them to the legitimate bank site, trigger an MFA prompt, and immediately present a matching fake verification screen. This precise timing is crucial for the scam's success, as victims are guided through providing SMS codes, purchase approvals, PINs, or card details under the guise of a bank verification process.

The platform supports up to 14 different screen types, allowing attackers to dynamically alter the narrative of a session and steer victims through the requested steps. This technique effectively places the attacker between the customer and the legitimate service, a method that bypasses traditional MFA defenses by mimicking real-time interaction. The "CallFlow" module further enhances social engineering by using AI, speech-to-text, and synthetic speech to conduct calls impersonating bank representatives, making suspicious calls feel personal and responsive.

Adding another layer of compromise, Balonx distributes a Spyroid-based Android RAT, disguised as a "bank-protection alert." Once installed, this malware establishes a persistent connection to its command server, exfiltrating screen content, keystrokes, SMS messages, and banking app activity. This transforms an account-phishing attempt into a potential full device takeover, aligning with a broader trend of Android banking threats that leverage fraudulent websites or calls to push malicious apps outside official app stores.

To mitigate these threats, bank customers are advised to end unexpected support calls and independently verify caller identity by using contact information from their official bank card or app. They should refrain from installing apps suggested by callers or unverified websites and treat any request for PINs, CVVs, or card scans as a significant red flag. Financial institutions are encouraged to monitor related infrastructure, unusual WebSocket activity, and suspicious redirect chains. For enhanced security, hardware security keys based on FIDO2 offer greater resistance to real-time relay attacks compared to SMS codes.