GhostBat RAT Uses Transparent Overlay to Steal PINs From 60 Indian Financial Apps
Do Son 
GhostBat RAT Infection Chain
At a Glance
| Malware Family | GhostBat RAT (operating within the GhostX operator ecosystem) |
| Threat Actor | Confirmed as the GhostX operator infrastructure; suspected Malware-as-a-Service (MaaS) model with unattributed individual operators |
| Target / Victims | Android users in India; 60 targeted financial and UPI apps (641 compromised devices and 244 stolen UPI PINs documented in prior related Firebase clusters) |
| Delivery Vector | SMS and WhatsApp smishing lures impersonating Indian government mParivahan and eChallan traffic portals, hosted on phishing domains and GitHub |
| Key Capabilities | Ghost Overlay transparent PIN capture, Accessibility keylogging, USSD call forwarding, SMS interception, Firebase Remote Config management |
| Sources | Cyble Research and Intelligence Labs, independent security researcher Karan Dhillon, and Indian state police advisories |
TL;DR
Cyble researchers uncovered a new Android GhostBat RAT campaign operating inside a larger cybercrime framework tracked as GhostX. This updated GhostBat RAT variant uses a transparent accessibility grid called Ghost Overlay to record and replay PIN taps inside Google Pay and MobiKwik. Furthermore, the malware monitors 60 Indian banking, UPI, and digital payment applications for credential theft.
Delivery and Attribution
Attackers distribute the malware through SMS and WhatsApp messages claiming the recipient owes an unpaid vehicle traffic fine. These lures direct Android users to fake Google Play pages or spoofed Indian government mParivahan and eChallan portals. Additionally, operators host the malicious installation packages on public GitHub repositories to bypass standard domain blocks. While unpacking a NextGen mParivahan sample, analysts uncovered an exposed Firebase project named ghostx-panel. According to the Cyble research report, “Instead, GhostX represents a broader operator-controlled ecosystem encompassing phishing infrastructure, backend services, Firebase-based configuration and command mechanisms, device-management functionality, and malware distribution.”
Confirmed Versus Suspected Attribution
Confirmed attribution links these fake traffic apps directly to the GhostX infrastructure, where live vehicle registration numbers and target phone numbers change daily. Meanwhile, suspected attribution points to a multi-tenant Malware-as-a-Service operation. Specifically, the exposed database contains separate administrator, user, and bot-user account roles alongside session tracking tables. While Cyble did not publish a total victim count for the newest panel, independent researcher Karan Dhillon documented 641 compromised devices and 244 stolen UPI PINs across five related mParivahan Firebase databases in August 2026. Furthermore, Indian press reports linked an earlier wave of this campaign to a 4.11 lakh INR fraud loss in Panchkula.
Infection Chain
Since October 2025, the Android GhostBat RAT delivery layer has evolved across six distinct loader designs to defeat static file scanners. Earlier builds relied on simple AES-CBC encryption, custom SPKZ containers, or remote payload downloaders. However, the newest variant hides its payload inside an encrypted application asset file and uses a native library named libnetbridge.so for unpacking.
Multi-Stage Native Unpacking
When a victim launches the fake traffic app, control passes to the native library. First, the loader processes the hidden asset through an RC4-like cipher and decrypts the output using AES-256-GCM. Next, it decompresses an intermediate object using zlib to reveal a custom container. This container holds a split Android package where the core malicious code resides inside a separate configuration DEX file. Once installed, the malware uses a boot receiver to restart its background services after every device reboot.
Command-and-Control and Data-Exfiltration Behavior
Once active, the GhostBat RAT requests Android Accessibility Service permissions to watch foreground applications. Its flagship feature, Ghost Overlay, targets Google Pay and MobiKwik without showing a fake login screen. When a victim opens a real PIN keypad, the malware draws a transparent 12-button grid directly over the numbers. When the user taps a digit, the invisible layer catches the coordinates and saves the number to an internal buffer. Next, the trojan releases the overlay briefly and uses the Android gesture dispatch API to replay the exact tap into the real app. As Cyble explained, “As a result, the legitimate application receives the expected input and continues operating normally, while the malware records the victim’s PIN in parallel.”
Keylogging and Dynamic Firebase Control
Beyond Google Pay and MobiKwik, the Android GhostBat RAT uses Accessibility events to capture numeric PIN entries across 60 Indian financial packages. Targeted apps include PhonePe, Paytm, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Groww, and Samsung Pay. A background worker queues stolen PINs and uploads them to a REST API backend. In addition, the malware intercepts incoming OTP text messages, sends bulk SMS lures from the victim’s SIM card, and dials USSD codes to forward incoming bank phone calls.
To keep operations resilient, the malware uses Firebase Remote Config alongside HTTPS endpoints and WebSocket tunnels. Operators can update the active command server address or toggle specific theft modules remotely without issuing a new APK file.
Defense and Detection Guidance
Because the malware changes its outer packers frequently, file hash detection offers weak protection. Police departments in Delhi and Telangana have warned citizens that official traffic enforcement agencies never send fine notices as APK files over SMS or WhatsApp. Therefore, drivers should check vehicle fines only on the official government portal at echallan.parivahan.gov.in.
Android users must keep Google Play Protect enabled and refuse Accessibility Service permissions for utility or government apps. Financial institutions should also monitor client sessions for synthetic touch injection gestures generated through Accessibility APIs. Finally, anyone who installs a fake mParivahan app should enable airplane mode, perform a factory reset, and reset all banking PINs from a clean device.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
