Threat reportMalwareTL-2026-3676
GhostBat RAT (GhostX ecosystem) Android Malware Steals UPI PINs via Fake Traffic Challan / mParivahan SMS Lures in India
GhostBat RAT (GhostX ecosystem) Android Malware Steals UPI (TL-2026-3676), also tracked as GhostBat, is a high-severity malware campaign, first published 2026-10-15. It has no confirmed attribution, affects Google Android (sideloaded APK; victims in India), maps to 20 MITRE ATT&CK techniques (T1406.002, T1407, T1417.001), and is covered by 9 detection rules and 20 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 20MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-3676
- Threat ID
- TL-2026-3676
- Also known as
- GhostBat, GhostBat RAT, GhostX, GhostX ecosystem
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, banking, fintech, payments, consumer
- Target regions
- india
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in GhostBat RAT (GhostX ecosystem) Android Malware Steals UPI
Malware and tooling: GhostBat RAT, GhostX, GhostBatRat_bot
How GhostBat RAT (GhostX ecosystem) Android Malware Steals UPI works
GhostBat RAT, an Android remote access trojan tracked by Cyble as part of the operator-controlled GhostX ecosystem, is spread via smishing links to fake Parivahan/eChallan and Google Play-style pages that push a fraudulent mParivahan APK. It abuses Accessibility Service to capture PINs across 60 banking, UPI, wallet and fintech apps, reads SMS/OTPs and manipulates call forwarding.
GhostBat RAT was first reported by Cyble Research and Intelligence Labs in October 2025 as a wave of Android malware masquerading as the Indian RTO / mParivahan app, distributed through WhatsApp and SMS shortened URLs that redirected to GitHub-hosted APKs and compromised websites. Cyble counted 40+ distinct samples at that time. Those samples used multi-stage droppers, ZIP header manipulation, heavy string obfuscation, native libraries for dynamic API resolution, XOR/AES encryption and anti-emulation checks. They harvested vehicle details, mobile numbers and UPI PINs through fake payment pages, forwarded bank-related SMS and OTPs, and registered each infected device with a Telegram bot (GhostBatRat_bot). Some variants carried cryptocurrency-mining functionality, and PINs were sent to a Firebase realtime-database endpoint.
On 2026-10-15 Cyble published 'The GhostX Ecosystem: Forged in Transit, Licensed to Deceive', which expands the picture. Investigation of fake mParivahan and eChallan apps exposed a wider operator-controlled ecosystem, GhostX, linking phishing pages, backend control systems and malware distribution. Victims receive smishing messages with links to pages impersonating the official Parivahan service or a Google Play-style download page, where they are pushed to install the fraudulent mParivahan APK. GitHub repositories repeatedly host the malicious files. Many APKs are first-stage loaders with the real payload delivered later, so an initial scan can miss the threat. Cyble documented at least six loader designs: native AES-CBC-protected APK containers, custom SPKZ/SPK1 payload formats, Java in-memory DEX loaders, remote APK downloaders, multi-stage XOR/AES loaders, and the newest design built on the native library libnetbridge.so, which layers RC4, AES-256-GCM and zlib decompression and uses custom MSZ1 / MSP1 container formats.
The latest GhostBat variant abuses the Android Accessibility Service in two ways. 'Ghost Overlay' places transparent accessibility overlay regions (an invisible 12-key grid) over the real PIN keypad of Google Pay and MobiKwik, records each tapped digit and replays the tap to the genuine app so the transaction succeeds while the PIN is exfiltrated. A separate accessibility-based keylogging mechanism targets 60 financial-app package identifiers (including PhonePe, Paytm, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge, PayZapp, Groww, Navi, Jupiter, OneCard, JioFinance and Samsung Pay). The implant also reads SMS, collects call logs, sends SMS from the victim SIM for propagation and manipulates call forwarding. Firebase Remote Config parameters (e.g. ghost_overlay_enabled, pin_target_packages, pin_min_digits) let operators switch features and command servers without redistributing the APK. Commands are delivered over HTTPS REST APIs (default backend api.cloudsettle.org), Firebase Cloud Messaging and configurable WebSocket tunnels.
An exposed Firebase backend named ghostx-panel revealed administrator records, user roles, login logs with device fingerprints and bot-to-user mappings, which suggests a multi-operator, possibly malware-as-a-service model. No individual actor, nation-state or CVE is attributed in the sources. Severity is analyst-assigned.
MITRE ATT&CK techniques used in TL-2026-3676
Defense Evasion
T1406.002 Software Packing; T1407 Download New Code at Runtime; T1633 Virtualization/Sandbox Evasion; T1655.001 Match Legitimate Name or Location
Credential Access
T1417.001 Keylogging; T1417.002 GUI Input Capture; T1453 Abuse Accessibility Features
Discovery
T1418 Software Discovery; T1426 System Information Discovery
Command and Control
defense-evasion
Collection
T1517 Access Notifications; T1636.002 Call Log; T1636.004 SMS Messages
Execution
Impact
T1582 SMS Control; T1616 Call Control
Persistence
Exfiltration
T1646 Exfiltration Over C2 Channel
Initial Access
Affected products and versions in GhostBat RAT (GhostX ecosystem) Android Malware Steals UPI
- Google — Android (sideloaded APK; victims in India)
Vulnerable versions: Devices that allow installation from unknown sources and grant Accessibility Service to the app - Various — UPI/banking/wallet apps targeted for PIN capture (Google Pay, MobiKwik, PhonePe, Paytm, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge, PayZapp, Groww, Navi, Jupiter, OneCard, JioFinance, Samsung Pay and others; 60 in total)
Remediation for GhostBat RAT (GhostX ecosystem) Android Malware Steals UPI
Immediate actions
- Do not tap links in SMS/WhatsApp messages about traffic challans, e-Challan or mParivahan; use only the official app from Google Play or the official government portal
- Block the api.cloudsettle.org domain and the listed phishing short-URLs at DNS/web proxy; alert on traffic to firebaseio.com realtime-database endpoints from unmanaged mobile devices
- Remove any sideloaded mParivahan APK, revoke Accessibility Service and SMS permissions from unknown apps, and reset UPI PINs and banking credentials on affected devices
- Check and disable unauthorized call forwarding on the SIM and review recent UPI/bank transactions
Workarounds
- Restrict Accessibility Service grants to vetted apps via MDM policy
- Block APK downloads from raw.githubusercontent.com and github.com release URLs on managed mobile gateways where feasible
Longer-term hardening
- Disable installation from unknown sources and enforce Google Play Protect on managed devices
- Deploy mobile threat defense with on-device runtime/dynamic detection since first-stage loaders defeat static scanning
- Run user awareness on smishing that impersonates government traffic or RTO services
Timeline of GhostBat RAT (GhostX ecosystem) Android Malware Steals UPI
- Zimperium's zDefend detects one GhostBat malware instance on a device before public disclosure; Cyble counts 40+ distinct samples by September 2025.
- GhostBat RAT first identified by Cyble Research and Intelligence Labs (CRIL) as RTO/mParivahan-themed Android malware targeting Indian users.
- Cyble publishes 'GhostBat RAT: Inside the Resurgence of RTO-Themed Android Malware', documenting WhatsApp/SMS short-URL delivery, GitHub-hosted APKs, multi-stage droppers, Telegram bot GhostBatRat_bot and Firebase PIN exfiltration.
- Zimperium publishes zero-day coverage of the GhostBat RAT campaign, stating its on-device engine detected the reported IOCs.
- The Cyber Express reports that fake traffic-challan texts are stealing UPI PINs from Android users in India via the latest GhostBat RAT variant.
- Cyble publishes 'The GhostX Ecosystem: Forged in Transit, Licensed to Deceive', exposing the GhostX operator ecosystem, the ghostx-panel Firebase backend, six loader designs including libnetbridge.so, the Ghost Overlay technique and 60 targeted financial apps.
Sources cited for GhostBat RAT (GhostX ecosystem) Android Malware Steals UPI
- GhostBat RAT Targets UPI PINs In 60 Indian Payment Apps (The Cyber Express)
- The GhostX Ecosystem: Forged in Transit, Licensed to Deceive (Cyble)
- The GhostX Ecosystem: Forged in Transit, Licensed to Deceive (malware.news mirror)
- GhostBat RAT: Inside the Resurgence of RTO-Themed Android Malware (Cyble)
- GhostBat RAT: Inside the Resurgence of RTO-Themed Android Malware (IOC/MITRE mirror)
- Rapid Response: Zimperium's Zero-Day Coverage of GhostBat RAT Campaign
- GhostBat RAT Malware Targets Indian Users Through Fake RTO Apps (Mobile ID World)
- GhostBat RAT Android Malware Targets Indian Users with Fake RTO Apps and Telegram Bot C2 (SecurityOnline)
- Reemergent GhostBat RAT malware targets India (SC Media)
Detection coverage for TL-2026-3676
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3676 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.