Inside BTMob: How a Source Code Leak Expanded Access to a Mobile RAT

BTMob, a mobile remote access trojan (RAT) capable of extensive device surveillance and data theft, has gained traction across cybercriminal communities following the leak of its source code in February 2026. Originally released in late 2024, the malware allows operators to monitor screens, intercept communications, capture keystrokes, and remotely control compromised mobile devices.

The leak has made these capabilities accessible to a wider range of cybercriminals. Flashpoint analysts have observed multiple unrelated actors successfully using BTMob, while others are reverse engineering, modifying, and reselling leaked versions. The growing number of variants also complicates attribution, as the same malware can now be deployed by actors with different objectives and levels of technical sophistication.

Meanwhile, disputes over counterfeit versions and potentially malicious copies have created uncertainty within BTMob’s underground market. Flashpoint’s research examines the actors behind the malware, how its distribution has evolved, and what its growing availability means for the mobile threat landscape.

BTMob’s Origins and Remote Access Capabilities

BTMob evolved from the SpySolr malware family and shares a common lineage with CraxsRAT and CypherRAT, mobile RATs associated with the Syria-based malware developer EVLF. First released in late 2024 and identified by security researchers in early 2025, BTMob has undergone multiple revisions as its developers continued introducing new versions.

The malware incorporates components written in VB.NET, Java, Node.js, PHP, MySQL, HTML, CSS, and JavaScript. Its capabilities provide operators with extensive access to compromised mobile devices, supporting both surveillance and data theft. These include:

• Screen monitoring and device control: Live viewing of device activity and remote interaction with compromised systems.
• Communications interception: Access to SMS messages and calls, potentially exposing sensitive communications and authentication information.
• Camera, microphone, and location access: Remote surveillance through device hardware and GPS tracking.
• Credential and activity collection: Keylogging and other capabilities for capturing user input.
• Application installation: The ability to silently install additional applications on compromised devices.

These functions give BTMob operators access to sensitive information and device activity that can support subsequent malicious operations. The combination of surveillance, communications interception, and remote application installation makes the RAT particularly concerning when deployed against devices used for financial transactions or access to sensitive accounts.

The Actors Behind BTMob

BTMob’s development and distribution involve several underground identities, although the precise relationships between the actors remain unclear. Version 4.0, released on January 25, 2025, appears to have been developed by an actor operating under the handles S1mp1y Ducky, ME8TE3N, and H7TEEN Anon. The latter is the identity most commonly associated with the developer, while DaarkShop, also known as GhostKernel, serves as the malware’s primary seller.

Both actors are credited in BTMob’s control panel, which also displays the phrase “BTMOB BY EVLF,” reflecting the malware’s connection to the broader EVLF lineage. While these references establish how the tool is presented and attributed within its interface, Flashpoint analysts have not confirmed the full extent of each actor’s development responsibilities.

DaarkShop actively promotes BTMob through Crax Shop, advertising it as a powerful mobile RAT capable of complete device control. Under the GhostKernel alias, the actor has also distributed tutorials demonstrating how to create custom payloads and connect to BTMob 4.0 infrastructure. Promotional materials include screenshots of the malware’s interface and capabilities such as injection, remote SSH access, and keystroke collection.

H7TEEN Anon has separately promoted the malware through Telegram. On March 15, 2026, the actor shared a video in the FP CC CHECK channel appearing to demonstrate BTMob controlling a mobile device through a Windows environment running in VMware. In a subsequent message, the actor claimed to sell additional malware, including stealers and ransomware, although Flashpoint has not established the extent of those activities.

The actor has also participated in discussions involving malicious large language models. On February 17, H7TEEN Anon shared a link purportedly offering access to WormGPT in the Reverse Engineering Lab Discussion Telegram channel. This activity suggests an interest in AI-enabled cybercriminal tooling, although it does not independently establish that such tools were used to develop BTMob.

How the BTMob Source Code Leak Reshaped Its Underground Market

In February 2026, source code for multiple BTMob versions appeared on underground forums, including Breach Forums. The leak weakened the original developers’ control over distribution and enabled other actors to obtain, modify, and resell the malware. In response, the developers released newer versions that they claimed offered improved security.

Flashpoint analysts observed a substantial increase in BTMob-related discussions as independent actors began advertising their own versions. The resulting market became increasingly fragmented, with competing sellers claiming to offer legitimate builds, modified versions, or access to the original malware.

The leak also created opportunities for fraud within cybercriminal communities. Some actors distributing BTMob have been accused of embedding malicious code in their packages, potentially compromising other criminals who download or purchase them. These allegations have contributed to disputes over which sellers can be trusted and whether redistributed versions contain additional malicious functionality.

Two distinct groups have emerged in this market: actors reverse engineering the malware and those primarily repackaging leaked source code. Their competing claims provide insight into how cybercriminal communities assess the authenticity and reliability of tools following a major source code leak.

Reverse Engineers Compete With Unauthorized BTMob Resellers

Among the actors advertising modified versions of BTMob is V0id.Ade1r, also known as PriceAde1r and Sparticus. The Russian- and English-speaking actor sells BTMob alongside other malware, including Celestial Rat and Sential Stealer, and has positioned their offerings as legitimate alternatives to potentially compromised copies circulating in underground markets.

V0id.Ade1r distinguishes their activity from straightforward resale, describing themselves as a “reverse engineer, not a reseller.” This positioning appears designed to appeal to buyers concerned about the reliability of leaked or repackaged versions. In one advertisement, the actor accused a Brazilian seller known as Boiano of distributing fake BTMob copies and impersonating EVLF.

Flashpoint has not identified known ties between V0id.Ade1r and BTMob’s core development team. However, the actor’s marketing illustrates how the source code leak has created demand for versions presented as independently examined or more trustworthy than those offered by unauthorized resellers.

Resellers Exploit Demand for Leaked BTMob Versions

Other actors have taken a less sophisticated approach, advertising access to leaked source code or claiming ownership of versions they may have obtained through the leak.

On March 29, 2026, a Telegram actor using the handle Owl claimed in the SH GROUP channel to have developed BTMob version 4.0. Flashpoint analysts assess that this claim was likely intended to establish credibility with potential buyers, as the actor appeared to offer only the source code for that particular version rather than demonstrating access to the malware’s broader development history.

This differs from the original developers’ distribution model, which centers on selling access to the malware rather than releasing its underlying source code. The distinction is significant because access to leaked code allows independent actors to create competing offerings without maintaining the original development infrastructure.

Another actor, R H, advertised a free seven-day BTMob trial in the Indian Hackers Telegram channel on April 8, 2026. The advertisement provided limited information and directed prospective users to a potentially malicious download location. Flashpoint could not establish whether the offering represented a legitimate BTMob build, a repackaged version, or an attempt to distribute additional malware.

These examples illustrate the competing incentives surrounding the leaked source code. While some actors seek to profit by modifying and supporting the malware, others attempt to capitalize on demand by reselling available versions or making questionable claims about their origins.

Stay Ahead of Emerging Mobile Malware With Flashpoint

BTMob’s evolution demonstrates how a source code leak can expand the reach of an established malware family and disrupt the underground market surrounding it. As independent actors continue distributing and modifying the RAT, its capabilities are available to a broader range of cybercriminals, creating additional opportunities for mobile device compromise and data theft.

Flashpoint monitors illicit communities, malware development, and threat actor activity to identify these changes and provide context for emerging threats. Request a demo to learn how Flashpoint’s primary source intelligence and analyst research help security teams track evolving malware threats and strengthen their defenses.