GhostBat RAT now watches 60 Indian finance apps for PINs, Cyble reports
Cyble says GhostBat RAT, spread by fake mParivahan and eChallan traffic-fine texts, now monitors 60 Indian banking, UPI and wallet apps for PINs. Its invisible-keypad overlay targets only Google Pay and MobiKwik.
The Watch · Security desk
Key figures: a keylogging feature monitors 60 financial apps for PINs; an invisible 12-key grid sits over the real PIN keypad in Google Pay and MobiKwik; Cyble identified at least six loader designs.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Financial apps the keylogging feature monitors for PINs | 60 apps | 8 | |
| Keys in invisible grid over PIN keypad | 12 keys | Targets Google Pay and MobiKwik | 7 |
| Loader designs, at least | 6 designs | 12 |
What happened
- Victims get SMS links to pages that impersonate Parivahan or a Google Play-style download page and push a fraudulent mParivahan APK.
- Researchers found GitHub repositories being used repeatedly to host the malicious files.
- The latest variant abuses Android's Accessibility Service, a capability earlier variants analyzed by Cyble did not have.
- An exposed Firebase backend named "ghostx-panel" held administrator records, user roles, login logs with device fingerprints and bot-user mappings.
- Cyble counts at least six loader designs, the newest built around a native library called libnetbridge.so.
Why it matters
- exposure Nothing on screen tells a victim the PIN has left the phone. Any control has to act before the install or the Accessibility grant.
- constraint Scans of the outer APK are unlikely to catch the newest loader consistently, and operators can swap command servers without a new app. In our view, blocking one server or flagging one build covers little.
- decision Cyble puts the decision at install time: official stores only, no APK links from SMS, social media or email, and close scrutiny of any Accessibility request.
The 60-app count belongs to a separate keylogging feature. Before it treats numbers the user types as a candidate PIN, it looks at the app in the foreground and at what is on screen [8]. Cyble's list includes PhonePe, Paytm, BHIM and SBI UPI [8].
The overlay works differently. It does not show a fake login screen [7]. It places an invisible 12-key grid over the real PIN keypad, records each digit the user taps, and replays the same tap into the genuine app [7]. The payment goes through and the PIN goes to the attackers' server [7].
Both features sit on top of older functions that Cyble says remain in play: reading SMS messages and OTPs, manipulating call forwarding, collecting call logs and sending SMS through the victim's SIM [9]. Cyble first identified GhostBat in October 2025 [1]. The change it documents between variants is one added capability on a trojan that already read OTPs [6][9]. The SIM-sending function could be used to spread further smishing campaigns, according to the write-up [9].
On the operator side, Cyble says the separate roles in the backend indicate that more than one operator is involved, and leave open the possibility that the malware is offered as Malware-as-a-Service [17]. That is an inference from roles and login logs, and Cyble frames it as a possibility. In our view the evidence for an active campaign is firmer. As researchers watched the backend, the SMS lures kept changing, and so did the phishing links, the vehicle registration numbers and the phone numbers the messages went to [10]. Users also reported matching eChallan messages on social media [11].
The Cyber Express write-up does not include victim counts, financial losses or a date for the latest variant. Every technical finding here is Cyble's, and the material cites no second researcher.
What to watch
- Whether Cyble or another researcher publishes evidence of GhostX access being sold, which would turn the Malware-as-a-Service possibility into a finding.
- Whether the GitHub repositories hosting the APKs are removed, and whether new ones appear.
- Whether the Ghost Overlay target list grows beyond Google Pay and MobiKwik.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption20
- Hype gap+10
- Incentives40
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
GhostBat RAT is an Android malware strain first identified by cybersecurity firm Cyble in October 2025.
- [2]
Cyble's new research says GhostBat RAT has evolved to capture PINs from 60 banking, UPI apps, wallet and fintech applications.
- [3]
The malware spreads mainly through smishing; victims receive links to pages impersonating the official Parivahan service or a Google Play-style download page, which push users to install a fraudulent mParivahan APK.
- [4]
Researchers found GitHub repositories being repeatedly used to host the malicious files.
- [5]
Many of the apps are only first-stage loaders; the real payload stays hidden in encrypted files or is downloaded later.
- [6]
The most significant change in the latest variant is its abuse of Android's Accessibility Service; earlier variants analyzed by Cyble did not have this capability.
- [7]
The Ghost Overlay feature targets Google Pay and MobiKwik. Instead of a fake login screen, it places an invisible 12-key grid over the real PIN keypad, records each tapped digit, replays the tap into the genuine app, and sends the PIN to the attackers' server while the payment goes through normally.
- [8]
A broader keylogging feature monitors 60 financial apps, including PhonePe, Paytm, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge, PayZapp, Groww, Navi, Jupiter, OneCard, JioFinance and Samsung Pay; it checks which app is open and the screen context before treating numeric input as a possible PIN.
- [9]
Older capabilities remain in play: reading SMS messages and OTPs, manipulating call forwarding, collecting call logs and sending SMS messages through the victim's SIM card, which could be used to spread further smishing campaigns.
- [10]
While monitoring the backend, researchers saw SMS lure text, phishing links, vehicle registration numbers and recipient phone numbers changing repeatedly, indicating an active campaign.
- [11]
Matching eChallan messages were also reported by users on social media.
- [12]
Cyble identified at least six different loader designs; the newest, built around a native library called libnetbridge.so, passes the payload through several layers of encryption, compression and custom packaging before the final app appears.
- [13]
Security tools that scan only the outer APK are unlikely to catch the newest loader consistently.
- [14]
The malware uses Firebase Remote Config, which lets operators switch command servers and turn features on or off remotely without pushing a new app to victims.
- [15]
Cyble advises users to install apps only from official stores such as Google Play, avoid APK links received by SMS, social media or email, be cautious about granting app permissions especially Accessibility access, verify website addresses, enable multi-factor authentication on financial apps and keep phones updated; anyone who suspects infection should contact their bank and local authorities immediately.
- [16]
An exposed Firebase backend named "ghostx-panel" contained administrator records, user roles, login logs with device fingerprints and bot-user mappings.
- [17]
Cyble says the separate roles in the backend point to a multi-operator setup and raise the possibility of a Malware-as-a-Service model.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- thecyberexpress.comFake Traffic Challan Texts Are Stealing UPI PINs From Android Users in India
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Entities
- CybleFollow
- GhostBat RATFollow
- Google PayFollow
- MobiKwikFollow