GhostBat Android Malware Targets 60 Indian Banking and UPI Apps

Key Takeaways

• A new variant of GhostBat Android malware is actively targeting users of 60 Indian banking, UPI, wallet, fintech, and payment applications.
• The malware leverages Android’s Accessibility Service to monitor app activity and stealthily capture PINs and other sensitive input.
• Initial infection vectors include smishing campaigns using fake mParivahan and eChallan messages, directing users to malicious APKs hosted outside official app stores.
• GhostBat has evolved beyond basic SMS theft, now possessing advanced capabilities such as call log collection, remote command execution, and dynamic configuration updates via Firebase.
• Users are advised to exercise extreme caution with unsolicited messages, only download apps from official sources, and meticulously review app permissions.

GhostBat Android Malware Intensifies Attacks on Indian Financial Apps

A sophisticated new iteration of the GhostBat Android malware has emerged, setting its sights on a wide array of 60 Indian banking, UPI, digital wallet, fintech, and payment applications. This advanced threat exploits Android’s Accessibility Service, enabling it to discreetly observe user interactions within targeted applications and compromise sensitive information, including PINs.

Operators behind this campaign are employing deceptive tactics, primarily through fake mParivahan and eChallan messages, to trick unsuspecting individuals into installing the malicious applications. This latest activity signifies a significant escalation in GhostBat’s capabilities, moving far beyond its initial scope as a simple SMS-stealing threat.

Beyond its enhanced PIN capture functionality, the malware is equipped to collect SMS messages and call logs, execute commands from its controllers, and modify its operational settings post-installation. This potent combination poses a severe risk to users of banking and payment services, as the malware can operate effectively even when victims interact with legitimate applications, circumventing typical fake login page detection.

Analysts from Cyble identified these new functionalities during their investigation into a broader threat operation they have designated GhostX. Cyble reports tracking GhostBat activity in India since October 2025, establishing clear connections between the malware, fraudulent government-service applications, phishing sites, and a centralized, operator-controlled backend infrastructure.

Infection Chain and Evolving Tactics

The attack typically commences with smishing, where users receive SMS or messaging-app messages containing malicious links disguised as traffic fines or official government service notifications. These links often redirect to counterfeit mParivahan or eChallan pages, or even to convincing imitations of Google Play Store download screens, coercing victims into installing malicious APK files from unofficial sources. Cyble’s research also uncovered instances of these malicious APKs being distributed via public GitHub repositories and other hosted file services.

This current campaign builds upon earlier GhostBat operations that utilized fake RTO (Regional Transport Office) applications to exfiltrate banking credentials and intercept SMS messages, including critical one-time passwords (OTPs). Similar deceptive challan lures have also been observed in the spread of other Android malware.

Upon successful installation, GhostBat aggressively requests elevated permissions, critically including access to the Android Accessibility Service. While this feature is designed to assist users with disabilities, the malware weaponizes it to read screen content and interact with other applications. If a user grants this access, GhostBat can then monitor which applications are active and cross-reference them against an internal list of targeted financial applications.

Cyble has documented a novel feature, dubbed “Ghost Overlay,” specifically targeting Google Pay and MobiKwik. Instead of presenting a fraudulent payment interface, this sophisticated technique layers transparent touch zones over the legitimate PIN keypad within the genuine application. The malware records the user’s PIN entries and then replays these actions to the actual payment app, allowing the transaction to proceed normally while the PIN is secretly captured. This method allows the victim to remain on the authentic application screen, unaware of the background data exfiltration.

Furthermore, a separate capability enables PIN-like input capture across a broader spectrum of 60 Android applications. This is achieved by analyzing Accessibility events and screen context to discern potential PIN entry fields, independent of the transparent keypad overlay method. Prominent Indian financial applications identified as targets include Google Pay, PhonePe, Paytm, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge, and PayZapp, among others. The comprehensive list includes 60 distinct app package identifiers.

This PIN capture functionality significantly augments GhostBat’s existing capabilities, which already include the collection of SMS messages (crucial for banking alerts and OTPs) and the harvesting of call logs and SIM card details.

Evasive Loaders and Remote Configuration

The malware’s delivery mechanisms have shown considerable variation across different samples. Cyble has identified at least six distinct loader or dropper types, encompassing encrypted APK containers, custom payload formats, in-memory DEX loading, and remote APK downloads.

The most recent sample employs a native library, libnetbridge.so, and a multi-stage process of encryption, transformation, and compression to unpack its final malicious payload. These layers of obfuscation are designed to complicate detection by basic security scanners, making it harder to inspect the hidden application.

GhostBat also utilizes Firebase Remote Config, specifically the Firebase project andromeda-d389d, with a configurable base_url value. This allows the operators to dynamically alter the malware’s settings and its command-and-control (C2) infrastructure without requiring a new APK distribution. Consequently, a C2 domain observed in one sample may not be the sole or permanent address used by the threat actors.

What You Should Do

• Only Download from Trusted Sources: Exclusively install applications from official app stores like Google Play. Avoid downloading APKs from untrusted websites, unsolicited links in messages, or third-party repositories.
• Scrutinize App Permissions: Carefully review the permissions requested by any app before granting them. A legitimate vehicle-service app, for instance, should not require extensive access to financial activities, SMS messages, or Accessibility Services. Be particularly wary of requests for Accessibility Service access from unfamiliar applications.
• Beware of Smishing: Exercise extreme caution with unexpected SMS or messaging-app messages, especially those purporting to be from government agencies (like mParivahan or eChallan) or banks. Do not click on links within these messages.
• Keep Software Updated: Regularly update your Android operating system and all installed applications. These updates often include critical security patches that protect against known vulnerabilities.
• Monitor Financial Accounts: Frequently check your banking and payment app statements for any suspicious or unauthorized transactions.
• Report and Act: If you suspect your phone or a payment account has been compromised, immediately contact your bank and report the suspicious activity. Consider performing a factory reset of your device and resetting all critical credentials.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.