GhostBat Android Malware Now Steals PINs From Inside 60 Real Banking and UPI Apps

A new variant of the GhostBat Android trojan has moved well past simple SMS theft. Researchers at Cyble report that it now watches activity inside 60 Indian banking, UPI, wallet and fintech apps and records PIN entry while the victim is using the genuine app, with no fake login page involved. The campaign is spread through fake traffic-fine and government-service messages.

What happened

Cyble says it has tracked GhostBat in India since October 2025. The current wave works like this:

• The lure. Victims receive an SMS or chat message that looks like a traffic challan or an official notice. The link leads to a cloned mParivahan or eChallan site, or to a page made to look like Google Play. Victims are pushed to sideload an APK. Some malicious APKs were also hosted in public GitHub repositories.
• The foothold. Once installed, the app asks for Accessibility Service access along with SMS, call-log and notification permissions. If the victim grants Accessibility, the malware can read the screen and interact with other apps.
• "Ghost Overlay." For Google Pay and MobiKwik, GhostBat lays invisible touch zones over the real PIN keypad. It logs each digit the user taps, then replays the taps so the payment goes through normally. The victim sees nothing unusual.
• Broader PIN capture. For the rest of its ~60 targets (Cyble names PhonePe, Paytm, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge and PayZapp among them), it uses Accessibility events and screen context to detect and capture PIN-like input.
• Everything else. The malware still steals SMS (including bank OTPs), call logs and SIM details. It can also send SMS remotely, control call forwarding and take operator commands.

Why it's hard to catch

GhostBat's delivery code keeps changing. Cyble counted at least six loader/dropper types, including encrypted APK containers, custom payload formats, in-memory DEX loading and remote APK downloads. The newest sample unpacks its payload through a native library (libnetbridge.so) and several layers of encryption and compression, which is enough to get past basic scanners.

The operators also use Firebase Remote Config to change backend URLs and features without shipping a new APK. A C2 domain seen in one sample may therefore not be the only one in use, so blocking a single indicator is not enough.

Why it matters

The usual advice is "check that you're on the real app before typing your PIN." That advice fails here, because the victim is on the real app. Once Accessibility is granted, the device is effectively shared with the attacker. With the PIN, OTPs and SMS control in hand, the operators have what they need to approve fraudulent transactions. Banks and fintechs should also note that the lure (fake government services) is easy to reuse against other brands and regions.

What to do

For individuals

• Install apps only from the official store. Never install an APK sent through a text, WhatsApp message or "pay your fine" link.
• Be suspicious of any app that asks for Accessibility, SMS or notification access. A vehicle-services or fine-payment app has no legitimate reason to need it.
• Review Settings → Accessibility and remove anything you don't recognise. Keep Android and your apps updated, and keep Google Play Protect enabled.
• If you think a phone is compromised, contact your bank immediately, change your UPI PIN from a clean device, and consider a factory reset.

For banks, fintechs and security teams

• Detect Accessibility-service abuse and overlays at runtime (e.g. FLAG_SECURE, overlay/tapjacking checks, Accessibility-service allow-listing in high-risk flows).
• Add these indicators to your threat-intel platform, SIEM and mobile threat defence. The domains are defanged here; re-fang them only inside controlled tooling:

• Watch for impersonation of government transport services and your own brand. Warn customers proactively about challan-themed smishing.

Credit: the technical findings in this article come from research by Cyble, as reported by Cyber Security News. This piece is 4Tify's own summary and analysis.