New GhostBat Android Malware Targets 60 Banking and UPI Apps to Steal PINs
GhostBat Android malware steals UPI PINs from 60 Indian banking apps using accessibility overlays and transparent keypads.
A new GhostBat RAT variant targets 60 Android financial packages used in India, including PhonePe, Paytm, BHIM, Google Pay, and MobiKwik. After Accessibility Service access is granted, Ghost Overlay places transparent touch regions over genuine PIN keypads and replays taps with dispatchGesture to reconstruct PINs. Captured PINs are queued by PinUploadWorker and sent to api.cloudsettle.org, which Cyble ties to the GhostX operator ecosystem. Delivery continues through mParivahan and eChallan smishing, GitHub-hosted APKs, and multistage loaders such as libnetbridge.so, with Firebase Remote Config used to change targets and command infrastructure.
- Ghost Overlay captures PINs on genuine banking apps without replacing the visible interface.
- A second accessibility method targets 60 configured banking, UPI, and wallet packages.
- Delivery uses mParivahan and eChallan smishing plus GitHub-hosted APKs.
- libnetbridge.so decrypts payloads with AES-256-GCM after an RC4-like transform.
- Cyble links the implant to the GhostX operator panel hosted on Firebase.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cloudsettle.org | ransmission to the /pin-data endpoint. Cyble identified api.cloudsettle[.]org as infrastructure receiving Ghost Overlay data, with capt |
From the original article
2 min read at gbhackers.com
A new GhostBat RAT variant targets 60 Android financial application packages used in India, combining accessibility-based PIN capture with a transparent overlay that intercepts interactions inside legitimate Google Pay and MobiKwik interfaces.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.