Hackers Use AI Voice Calls and Fake Banking Pages to Bypass MFA and Steal Accounts
Brief
Hackers are pairing AI-generated phone calls with fake banking pages to take over customer accounts, even when multi-factor authentication is enabled.
The campaign, tracked as Balonx Sistema, gives criminals a live view of a victim’s phishing session and lets them request information at the precise moment it is needed.
The operation targets more than 20 Mexican financial institutions and has collected credentials and financial data from over 1,100 people since at least October 2025.
It is built as a subscription service, lowering the barrier for affiliates who want to run banking scams at scale. It has individual and office plans, giving multiple operators controlled access to victim sessions and selected banking brands.
Analysts at Group-IB identified the platform after leaked GitHub repositories exposed parts of its operation, including its infrastructure and affiliate network.