BTMOB is an Android remote access trojan offered as malware-as-a-service (MaaS) with a builder interface for generating custom phishing payloads. The malware steals specific data, intercepts financial transactions, captures screenshots, and provides remote control capabilities. It abuses Android Accessibility Services to obtain elevated permissions and additional system access without user interaction. The APK builder allows customization without coding, enabling selection of permissions and actions like disabling Google Play, hiding icons, and preventing sleep mode. It is distributed via phishing websites masquerading as streaming services and cryptocurrency mining platforms, redirecting victims to fake Google Play stores.