Hackers Target 60 Indian Banking and UPI Apps With New GhostBat Android Malware

A new version of GhostBat Android malware is targeting users of 60 banking, UPI, wallet, fintech and payment apps in India. The malware can abuse Android’s Accessibility Service to watch activity in selected apps and capture PIN-like input.

Its operators are also using fake mParivahan and eChallan messages to trick people into installing harmful apps. The latest activity shows GhostBat has grown beyond an SMS-stealing threat.

The malware can collect messages and call logs, handle commands from its operators and change some of its settings after installation.

That mix puts banking and payment users at risk, even when they open the real app and do not see a fake login page. Analysts from Cyble identified the new capabilities while investigating a wider operation they call GhostX.

Cyble said it has tracked GhostBat activity in India since October 2025 and found links between the malware, fake government-service apps, phishing pages and an operator-controlled backend.

Hackers Target 60 Indian Banking and UPI Apps

The campaign begins with smishing: SMS or messaging-app messages that contain a link and pose as a traffic fine or government service notice.

The link can open a fake mParivahan or eChallan page, or a page that looks like a Google Play download screen. Victims are urged to install an APK file outside the official app store. Cyble also found malicious APKs shared through public GitHub repositories and hosted files.

This approach builds on earlier GhostBat activity in which fake RTO apps were used to steal banking data and read SMS messages, including one-time passwords. Readers can compare that earlier campaign with this report in Cyber Security News’ coverage of GhostBat RAT.

Similar fake challan lures have also been used to spread other Android malware, as described in this report on RTO challan notification scams.

Once installed, GhostBat may ask for sensitive access, including Accessibility Service access. This Android feature is designed to help people use their devices, but malware can misuse it to read screen content and interact with apps.

If a victim grants access, GhostBat can check which app is open and compare it with a list of financial apps selected by its operators.

Cyble found a feature it calls Ghost Overlay, which targets Google Pay and MobiKwik. Rather than showing a fake payment screen, the malware places transparent touch areas over the PIN keypad in the genuine app.

It records the digits a user taps, then replays the same touches so the payment app receives them and continues as normal. The victim may remain on the real screen while GhostBat captures the PIN in the background.

A separate feature can capture PIN-like input across a broader set of 60 Android apps. It uses Accessibility events and screen context to identify possible PIN entry, instead of relying on the transparent keypad overlay.

Cyble named apps including Google Pay, PhonePe, Paytm, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge and PayZapp among the targeted services. The report says the full target set contains 60 app package identifiers.

The PIN capture adds to GhostBat’s ability to collect SMS messages, including banking alerts and OTPs, and to gather call-log and SIM details.

Loaders and remote settings complicate detection

The report also describes call-forwarding controls and remote SMS activity. These functions could give operators several routes to monitor a compromised phone and support financial fraud.

The malware’s delivery code has changed across samples. Cyble observed at least six loader or dropper types, including encrypted APK containers, custom payload formats, in-memory DEX loading and remote APK downloads.

The newest sample uses a native library called libnetbridge.so and a chain of encryption, transformation and compression stages to unpack its final payload. These layers can make it harder for basic scanners to inspect the hidden app.

GhostBat also uses Firebase Remote Config to change settings without distributing a new APK. The analyzed sample used the Firebase project andromeda-d389d and a configurable base_url value.

This lets operators change the active backend or selected features remotely, so a domain observed in one sample may not remain the only command-and-control address.

For context on another Android threat that abuses Accessibility to capture banking PINs, see this report on Manic’s PIN capture methods.

Install apps from trusted stores and avoid APK links delivered through unexpected texts or messages. Check an app’s publisher and purpose before granting Accessibility, SMS or notification access; a vehicle-service app should not need broad access to financial activity.

Keep Android and apps updated, and contact your bank promptly if you suspect a phone or payment account has been compromised. Cyble also advises users to report suspicious activity and consider resetting credentials or the device when infection is suspected.

The central risk is not only that GhostBat targets many financial apps, but that its transparent overlay can record PIN taps while the genuine payment app remains in use.

Fake government-service lures, broad Accessibility access and changeable backend settings give the operators multiple ways to adapt the campaign.

Indicators of compromise (IoCs):-

Type	Indicator	Notes
C2 domain	hxxps://api[.]cloudsettle[.]org	Default backend observed in the analyzed sample
C2 endpoint	/pin-data	Receives captured PIN-related data
Firebase project	andromeda-d389d	Remote configuration for the analyzed sample
Firebase project	ghostx-panel	Linked to an earlier mParivahan sample
Native library	libnetbridge.so	Used by the latest reported loader
App asset	assets/isti52q4	Stores an encrypted payload
Overlay package	com.mobikwik_new	Listed for Ghost Overlay
Overlay package	com.google.android.apps.nbu.paisa	Listed for Ghost Overlay
Overlay package	com.google.android.apps.nbu.paisa.user	Listed for Ghost Overlay

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.