Android RAT phishing in Mexico: what should banking teams do now?

TL;DR: A sprawling Meta Ads phishing operation used Netflix-themed lures, centralized campaign management and a newly identified Android remote access trojan to target Spanish-speaking users in Mexico, according to Intel 471, with one panel logging more than 350,000 visits and nearly 15,000 malicious app downloads in a week. Brand impersonation, accessibility abuse and mobile credential theft now converge in a workflow defenders must treat as an identity risk, not just malware.

Editorial analysis by NHI Mgmt Group, based on content published by Intel 471: “Chinese-speaking threat actors targeting Mexican Android users with remote access Trojan”.

By the numbers:

• Over a one-week campaign beginning on July 2, 2026, the panel logged more than 350,000 landing page visits, 200,000 unique visitors and nearly 15,000 malicious app downloads.
• The campaign targeted 62 banks and financial institutions across Mexico and Nigeria.
• BAT1688 re-signed APK payloads on a rotating schedule every 60 minutes to evade static detection.

Key questions

Q: How should security teams reduce risk from malicious Android apps that abuse user trust?

A: Prioritise install-path controls, permission governance and brand-abuse monitoring.

Q: Why do Android accessibility permissions create such high fraud risk?

A: Because they let an app observe interaction data that users assume is private, including screen content and input events.

Q: What are the signs that a mobile phishing campaign is accelerating?

A: A campaign is accelerating when new suspicious domains appear suddenly, message volume rises in bursts, and the same sender keeps reappearing with minor wording changes.

Practitioner guidance

• Harden mobile app-install policies Block or tightly restrict installs from unknown sources on managed Android devices and require explicit approval for any exception path.
• Treat accessibility grants as sensitive privilege Monitor and review accessibility service permissions as a high-risk event, especially on devices used for banking, payments or customer authentication.
• Correlate domain, ad and C2 telemetry Join newly registered domains, ad attribution patterns and outbound C2 activity so campaign pivots can be detected before stolen credentials are used.

Bottom line: This campaign shows how malvertising, fake brands and Android permission abuse can merge into a single credential theft path.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →