Hackers Exploit AI and Fake Banking Sites to Bypass MFA

Cybercriminals are employing artificial intelligence to orchestrate sophisticated attacks on financial institutions, specifically targeting customer accounts protected by multi-factor authentication (MFA). A newly identified campaign leverages AI-generated voice calls along with counterfeit banking websites to breach security layers and gain unauthorized access.

Innovative Phishing Tactics Threaten Banks

Dubbed Balonx Sistema, this operation provides attackers with real-time access to a victim’s phishing session. By interacting at critical moments, hackers can extract sensitive information more effectively. The campaign has been linked to over 20 Mexican banks and has compromised the credentials of more than 1,100 individuals since October 2025.

The scheme is designed as a subscription service, simplifying access for affiliates keen to execute large-scale banking scams. Options include individual and office plans, allowing multiple operators to manage victim sessions under various banking brands.

Technical Insights into Balonx Sistema

According to analysts at Group-IB, the platform’s infrastructure and affiliate network were uncovered through leaked GitHub repositories. Balonx Sistema merges live phishing with an Android remote-access tool and automated voice scams, creating a seamless attack progression from phone call to web interaction, and sometimes to malicious mobile apps.

Utilizing a persistent WebSocket connection, the phishing sites remain synchronized with the attackers’ control panel. When victims input their banking details, hackers can prompt MFA requests and present fraudulent verification screens, making the attack appear legitimate.

Defensive Measures and Recommendations

The campaign includes a CallFlow module that enhances social engineering techniques. This module uses AI to simulate calls from a bank representative, making interactions appear authentic without human operators.

Balonx Sistema extends its reach by distributing a Spyroid-based Android remote access trojan through fake security alerts. Once installed, the app maintains a connection with the attackers, transmitting data such as keystrokes and SMS messages.

To safeguard against these threats, customers should independently verify any unexpected bank communications by contacting their financial institutions directly. Additionally, they should avoid downloading apps from unofficial sources and be wary of requests for sensitive information such as PINs and CVVs.

Financial institutions are advised to monitor for suspicious activities, such as unusual WebSocket connections and redirect chains. For high-security users, hardware keys based on FIDO2 standards offer better protection against these sophisticated relay attacks than traditional SMS codes.

Anyone suspecting they have been targeted should promptly contact their bank, change their credentials, and review their recent transaction history for unauthorized activities.