New GhostBat RAT Variant Targets Android Financial Applications in India
A recently discovered variant of GhostBat, a sophisticated Remote Access Trojan (RAT), is now actively targeting at least 60 financial application packages commonly used in India. This alarming development brings new dimensions to cybersecurity threats, as the malware employs both an accessibility-based PIN capture method and a transparent overlay designed to intercept user interactions with legitimate financial applications, including popular platforms like Google Pay and MobiKwik.
The findings arise from an extension of Cyble’s investigation, which originally documented GhostBat’s spread through fraudulent applications of mParivahan back in October 2025. These initial examinations revealed the malware’s capabilities in harvesting banking messages and stealing Unified Payments Interface (UPI) PIN numbers through deceptive payment screens. Remarkably, the latest GhostBat variant escalates the threats by moving beyond phishing interfaces to actively capture user inputs while victims engage with legitimate applications.
One of the most distinctive capabilities of this new GhostBat variant is the introduction of a feature known as Ghost Overlay. To utilize this function, victims must grant the malware access to the Android Accessibility Service. Once this access is granted, the malicious software begins monitoring the foreground applications and identifying specific contexts conducive to PIN entry. The malware then overlays twelve transparent touch regions over the real numeric keypad, using Android’s TYPE_ACCESSIBILITY_OVERLAY window type.
When users select a digit from the keypad, the overlay intercepts this touch event, mapping its coordinates to the corresponding keypad value. The GhostBat malware effectively simulates the touch event within the legitimate application, thereby capturing the user’s input without altering the visible interface. This method allows the malware to track delete and confirmation actions, enabling it to reconstruct completed PIN sequences without the need for overt manipulation of the user interface.
In addition to this overlay mechanism, a separate, accessibility-based capture method expands targeting to an impressive 60 package identifiers connected to banking, UPI, wallet, fintech, and payment services. High-profile applications such as PhonePe, Paytm, BHIM, BharatPe, and CRED are included within the malware’s scope, although it is essential to note that these targets represent configured packages, not a guarantee of successful compromises across all applications.
Any captured PINs by GhostBat are queued locally by a component identified as PinUploadWorker before they are eventually transmitted to the /pin-data endpoint. Cyble’s research further identified the infrastructure responsible for receiving data from Ghost Overlay, pinpointing the domain api.cloudsettle[.]org as a primary recipient of these stolen records. Entries captured are tagged to help ascertain their source, emphasizing the malware’s systematic approach in gathering sensitive data.
Moreover, Cyble’s investigation has linked GhostBat to a larger ecosystem known as GhostX. This ecosystem is meticulously designed for operator control and includes components that facilitate phishing, device management, backend configuration, and the distribution of malware. During the analysis of a malicious NextGen mParivahan sample, researchers uncovered the Firebase project identifier “ghostx-panel.” This exposed backend system was found to contain an array of sensitive information, including client records, administrator accounts, bot-user mappings, login timestamps, device fingerprints, and session management data.
Continuous alterations to SMS tactics, phishing URLs, vehicle registration numbers, and recipient phone numbers suggest ongoing supervision and management of the malware campaigns. The distinct roles assigned to administrators and users imply a multi-operator model, leading Cyble to describe a Malware-as-a-Service operating framework as a potential, albeit unconfirmed, commercial option.
Delivery of this variant continues through smishing campaigns themed around mParivahan and eChallan, utilizing misleading download pages and APKs hosted on GitHub. Cyble identified at least six loader strategies employed by the malware, which range from encrypted APK containers to remote downloaders and intricate multi-stage native unpacking processes. The most recent loader, named libnetbridge.so, processes encrypted assets through complex transformations, ultimately recovering split APK components with malicious executable code primarily housed within split_config.dex.apk. These layers introduce additional complexity to static analysis and automated payload extraction processes.
Furthermore, Firebase Remote Config offers operators the ability to adjust command infrastructure parameters, modify target packages, and select specific capabilities without necessitating the redistribution of the APK. The malware also combines HTTPS protocols, Firebase services, and a configurable WebSocket tunnel for operational control.
In light of this evolving threat landscape, users are strongly advised to remain vigilant. This includes avoiding APKs that arrive through unsolicited messages related to traffic fines, verifying application legitimacy through official sources, and carefully scrutinizing permission requests before granting access. Those who suspect they have fallen victim to this malware should contact their bank immediately to report the incident and protect their financial assets.
In a world where cyber threats continue to evolve rapidly, the need for proactive cybersecurity measures becomes increasingly crucial. Awareness and education are vital components in safeguarding against these insidious malware variants, ensuring that individuals can protect their sensitive information from malicious actors.