Hackers Target 60 Indian Banking and UPI Apps With New GhostBat Android Malware
GhostBat Android malware targets 60 Indian banking and UPI apps, capturing PINs via Accessibility overlays.
Cyble reported a new GhostBat Android malware build used in an operation called GhostX against users of 60 Indian banking, UPI, wallet and payment apps. Operators send fake mParivahan and eChallan messages that lead to sideloaded APKs, then abuse Accessibility Service and a transparent Ghost Overlay to capture PINs while the genuine app stays on screen. The malware also collects SMS, OTPs, call logs and SIM details, and samples use several loaders, including native library libnetbridge.so. Operators pull remote settings from Firebase project andromeda-d389d; the analyzed sample used api.cloudsettle.org as its default backend.
72