BRIEFOtherhighP55
BTMOB 3.6.3 Android banking trojan source code leaked
BTMOB (LATAM Android banking trojan)
Detected19 October 2026 · 11:38 UTC
Complete source code, reseller panel/server code and video tutorials for the BTMOB Android banking trojan are being shared, lowering the bar for new operators to build ATS/overlay campaigns. BTMOB is used against Latin American banks and their customers, so wider availability directly increases fraud risk for Argentine and regional financial institutions. Banks should update mobile-fraud detection for the 3.6.3 build and monitor for new reseller-distributed variants.
CategoryOther
Severityhigh
Priority score55
Detected19 October 2026 · 11:38 UTC
Other● 52
Reclutan infiltrados en bancos, telcos y gobiernosA buyer is openly recruiting insiders among bank, telecom and government staff, seeking employees willing to provide access or data. Insider recruitment is a precursor to fraud and intrusions against regulated sectors. Defenders in finance, telco and the public sector should reinforce insider-threat monitoring and access controls.Other● 50
Reclutamiento de infiltrados en bancos, telcos y gobiernoA buyer on BreachForums and RaidForums is openly soliciting insiders at banks, telecom operators and government agencies, presumably to obtain privileged access or credentials. The fresh post dated October 19, 2026 signals active demand for insider access to financial, telco and public-sector targets. Defenders in these sectors should tighten insider-threat monitoring and privileged-access controls.Other● 27
Se buscan datos de Serasa Experian e inmobiliaria brasileñaA forum buyer posted a standing request for complete Serasa Experian data plus Brazilian real estate records, indicating continued demand for LATAM credit-bureau and property datasets. It is a demand-side post from August 2025, not a leak, so there is no confirmed exposure of the credit bureau itself. Useful only as context on buyer interest in Brazilian financial and property data.Other● 42
Herramienta de evasión de KYC y documentos falsos para Sumsub, Onfido y otrosA tool automating KYC bypass and fake document creation is circulating on Cracked.st, explicitly targeting Sumsub, Onfido, Persona, Jumio, IDnow and Ondato. These providers underpin onboarding and identity checks at many banks and fintechs across Latin America, so the tool undermines a core financial-crime control. Fraud and onboarding teams should expect increased synthetic-identity and account-opening abuse.Other● 42
Doxeo del expresidente mexicano Andrés Manuel López ObradorA forum user posted a dox of former Mexican president Andrés Manuel López Obrador. Although this is personal data rather than a system compromise, doxing of a former head of state signals political targeting and can enable harassment or identity fraud. It is worth tracking as LATAM political-risk intelligence.Other● 38
Comprador busca enriquecimiento y búsqueda de datos personales de BrasilA buyer is soliciting Brazilian personal-data enrichment and lookup services, indicating active demand for Brazilian PII on underground markets. While not a leak itself, it shows targeting of Latin American data and could precede downstream fraud. Worth tracking for LATAM-focused activity.