The GhostX Ecosystem: Forged in Transit, Licensed to Deceive
GhostBat RAT, part of the GhostX ecosystem, steals banking PINs from Android users in India via smishing and overlays.
Cyble says GhostBat RAT, tracked since October 2025, is part of a broader operator ecosystem called GhostX that targets Android users in India with mParivahan and eChallan smishing. The latest variant abuses the Accessibility Service so a transparent Ghost Overlay records PIN entry in Google Pay and MobiKwik and replays the touches into the real apps, while keylogging covers 60 banking, UPI, wallet, and fintech applications. At least six loaders were observed; the newest, libnetbridge.so, uses encryption, compression, and custom containers, and Firebase Remote Config can change command-and-control and features without redistributing the APK. Exposed backend records showed device control, SMS instructions, call forwarding, and changing phishing content.