GhostBat Android Malware Targets Indian Banking and UPI Apps

Cyble says GhostBat, part of GhostX, uses smishing and Accessibility overlays to steal PINs from users of 60 Indian finance apps.

Cyble reported that GhostBat, Android malware tracked in India since October 2025, belongs to an operator ecosystem it calls GhostX. Fake mParivahan and eChallan messages push victims toward sideloaded APKs, which Cyble says have also appeared on GitHub. The newest variant uses Accessibility Service and a transparent Ghost Overlay to record PIN entry in Google Pay and MobiKwik while the genuine app stays visible; Cyble adds that the overlay replays those touches into the real apps, a detail the second report does not repeat. Coverage centers on 60 banking, UPI, wallet, and fintech or payment apps, with Cyber Security News naming PhonePe, Paytm, BHIM, CRED, and PayZapp, and the malware is also said to collect SMS, OTPs, call logs, and SIM details. Cyble counted at least six loaders and identified libnetbridge.so as the newest, using encryption, compression, and custom containers, while the later account says samples use several loaders including that library but does not repeat the count of six. Operators change settings through Firebase Remote Config project andromeda-d389d, one analyzed sample defaulted to api.cloudsettle.org, and exposed backend records showed device control, SMS instructions, call forwarding, and editable phishing content.

• Cyble has tracked GhostBat in India since October 2025 and describes it as part of the GhostX operator ecosystem.
• Smishing texts impersonate mParivahan and eChallan and lead to sideloaded APKs; Cyble says some packages were hosted on GitHub.
• The latest build abuses Accessibility Service and a transparent Ghost Overlay to capture PIN entry in Google Pay and MobiKwik; Cyble also says those touches are replayed into the real apps.
• The campaign covers 60 Indian banking, UPI, wallet, and fintech or payment apps, including PhonePe, Paytm, BHIM, CRED, and PayZapp.
• Reported collection and control include SMS, OTPs, call logs, SIM details, device control, SMS instructions, call forwarding, and changes to phishing content.
• Cyble reported at least six loaders, the newest being native library libnetbridge.so with encryption, compression, and custom containers; the later report says several loaders including that library.
• Remote settings come from Firebase Remote Config project andromeda-d389d, and one analyzed sample used api.cloudsettle.org as its default backend.