# GhostBat RAT (GhostX ecosystem) Android Malware Steals UPI PINs via Fake Traffic Challan / mParivahan SMS Lures in India

> GhostBat RAT, an Android remote access trojan tracked by Cyble as part of the operator-controlled GhostX ecosystem, is spread via smishing links to fake Parivahan/eChallan and Google Play-style pages that push a fraudulent mParivahan APK. It abuses Accessibility Service to capture PINs across 60 banking, UPI, wallet and fintech apps, reads SMS/OTPs and manipulates call forwarding.

- **Published:** 2026-10-15T23:19:29Z
- **Last reviewed:** 2026-10-15T23:19:29Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3676
- **ID:** TL-2026-3676
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

GhostBat RAT was first reported by Cyble Research and Intelligence Labs in October 2025 as a wave of Android malware masquerading as the Indian RTO / mParivahan app, distributed through WhatsApp and SMS shortened URLs that redirected to GitHub-hosted APKs and compromised websites. Cyble counted 40+ distinct samples at that time. Those samples used multi-stage droppers, ZIP header manipulation, heavy string obfuscation, native libraries for dynamic API resolution, XOR/AES encryption and anti-emulation checks. They harvested vehicle details, mobile numbers and UPI PINs through fake payment pages, forwarded bank-related SMS and OTPs, and registered each infected device with a Telegram bot (GhostBatRat_bot). Some variants carried cryptocurrency-mining functionality, and PINs were sent to a Firebase realtime-database endpoint.

On 2026-10-15 Cyble published 'The GhostX Ecosystem: Forged in Transit, Licensed to Deceive', which expands the picture. Investigation of fake mParivahan and eChallan apps exposed a wider operator-controlled ecosystem, GhostX, linking phishing pages, backend control systems and malware distribution. Victims receive smishing messages with links to pages impersonating the official Parivahan service or a Google Play-style download page, where they are pushed to install the fraudulent mParivahan APK. GitHub repositories repeatedly host the malicious files. Many APKs are first-stage loaders with the real payload delivered later, so an initial scan can miss the threat. Cyble documented at least six loader designs: native AES-CBC-protected APK containers, custom SPKZ/SPK1 payload formats, Java in-memory DEX loaders, remote APK downloaders, multi-stage XOR/AES loaders, and the newest design built on the native library libnetbridge.so, which layers RC4, AES-256-GCM and zlib decompression and uses custom MSZ1 / MSP1 container formats.

The latest GhostBat variant abuses the Android Accessibility Service in two ways. 'Ghost Overlay' places transparent accessibility overlay regions (an invisible 12-key grid) over the real PIN keypad of Google Pay and MobiKwik, records each tapped digit and replays the tap to the genuine app so the transaction succeeds while the PIN is exfiltrated. A separate accessibility-based keylogging mechanism targets 60 financial-app package identifiers (including PhonePe, Paytm, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge, PayZapp, Groww, Navi, Jupiter, OneCard, JioFinance and Samsung Pay). The implant also reads SMS, collects call logs, sends SMS from the victim SIM for propagation and manipulates call forwarding. Firebase Remote Config parameters (e.g. ghost_overlay_enabled, pin_target_packages, pin_min_digits) let operators switch features and command servers without redistributing the APK. Commands are delivered over HTTPS REST APIs (default backend api.cloudsettle.org), Firebase Cloud Messaging and configurable WebSocket tunnels.

An exposed Firebase backend named ghostx-panel revealed administrator records, user roles, login logs with device fingerprints and bot-to-user mappings, which suggests a multi-operator, possibly malware-as-a-service model. No individual actor, nation-state or CVE is attributed in the sources. Severity is analyst-assigned.

## MITRE ATT&CK

- T1660 Phishing
- T1575 Native API
- T1624.001 Broadcast Receivers
- T1655.001 Match Legitimate Name or Location
- T1406.002 Software Packing
- T1407 Download New Code at Runtime
- T1633 Virtualization/Sandbox Evasion
- T1453 Abuse Accessibility Features
- T1417.001 Keylogging
- T1417.002 GUI Input Capture
- T1516 Input Injection
- T1426 System Information Discovery
- T1418 Software Discovery
- T1636.004 SMS Messages
- T1636.002 Call Log
- T1517 Access Notifications
- T1437.001 Web Protocols
- T1646 Exfiltration Over C2 Channel
- T1582 SMS Control
- T1616 Call Control

## Sources

- [GhostBat RAT Targets UPI PINs In 60 Indian Payment Apps (The Cyber Express)](https://thecyberexpress.com/ghostbat-rat-targets-upi-pins/)
- [The GhostX Ecosystem: Forged in Transit, Licensed to Deceive (Cyble)](https://cyble.com/blog/ghostx-forged-in-transit-licensed-to-deceive/)
- [The GhostX Ecosystem: Forged in Transit, Licensed to Deceive (malware.news mirror)](https://malware.news/t/the-ghostx-ecosystem-forged-in-transit-licensed-to-deceive/126434)
- [GhostBat RAT: Inside the Resurgence of RTO-Themed Android Malware (Cyble)](https://cyble.com/blog/ghostbat-rat-inside-the-resurgence-of-rto-themed-android-malware/)
- [GhostBat RAT: Inside the Resurgence of RTO-Themed Android Malware (IOC/MITRE mirror)](https://www.hendryadrian.com/?p=82253)
- [Rapid Response: Zimperium's Zero-Day Coverage of GhostBat RAT Campaign](https://zimperium.com/blog/rapid-response-zimperiums-zero-day-coverage-of-ghostbat-rat-campaign)
- [GhostBat RAT Malware Targets Indian Users Through Fake RTO Apps (Mobile ID World)](https://mobileidworld.com/ghostbat-rat-malware-targets-indian-users-through-fake-rto-apps/)
- [GhostBat RAT Android Malware Targets Indian Users with Fake RTO Apps and Telegram Bot C2 (SecurityOnline)](https://securityonline.info/ghostbat-rat-android-malware-targets-indian-users-with-fake-rto-apps-and-telegram-bot-c2/)
- [Reemergent GhostBat RAT malware targets India (SC Media)](https://www.scworld.com/brief/reemergent-ghostbat-rat-malware-targets-india)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3676