Skip to navigation

Threat reportMalwareTL-2026-5434

GhostBat Android Banking Malware Targets 60 Banking and Payment Apps in India

highACTIVE

GhostBat (GhostBat RAT) is an Android malware family that abuses Accessibility Services to steal UPI/payment PINs via a transparent 'Ghost Overlay' and to intercept SMS/OTP messages. The updated variant targets 60 Indian banking, UPI and wallet apps and is spread through fraudulent mParivahan/eChallan traffic-fine smishing and malicious app downloads. First disclosed .

Key facts for GhostBat RAT Ghost Overlay

IdentifiersTL-2026-5434
Also known asGhostBat RAT, Ghost Overlay
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsGoogle Android (devices where a malicious app is granted Accessibility Service and overlay permissions); Multiple (Indian banks and UPI/wallet providers) 60 targeted banking, UPI and payment apps incl. PhonePe, Paytm, BHIM, BharatPe, CRED, Google Pay, MobiKwik, SBI UPI, Axis Pay, Groww, Samsung Pay
MalwareGhostBat RAT, GhostX
MITRE ATT&CK techniquesT1406.002 Obfuscated Files or Information: Software Packing, T1407 Download New Code at Runtime, T1417.001 Input Capture: Keylogging, T1417.002 Input Capture: GUI Input Capture, T1424 Process Discovery, T1426 System Information Discovery, T1437.001 Application Layer Protocol: Web Protocols, T1481 Web Service, T1575 Native API, T1636.004 Protected User Data: SMS Messages, T1646 Exfiltration Over C2 Channel, T1655.001 Masquerading: Match Legitimate Name or Location and 1 more in the attack flow
MotivationFINANCIAL
Target sectorsfinance, banking, payments, fintech, consumers
Target regionsindia
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage for GhostBat RAT Ghost Overlay

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5434 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: GhostBat RAT - DNS Resolution of Ghost Overlay Receiver api.cloudsettle.org

Detects any DNS lookup of api.cloudsettle.org or its subdomains, the Ghost Overlay data receiver to which the updated GhostBat variant (TL-2026-5434) exfiltrates stolen UPI PINs. A hit on a mobile or BYOD client indicates a likely infected device.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1437.001, T1481, T1646
  • Data sources: stream:dns (index=network), DnsEvents (Microsoft Sentinel DNS), dns logsource (Sigma)
  • Severity: critical
  • Confidence: high

Splunk SPL

index=network sourcetype="stream:dns" earliest=-24h
| eval q=lower(rtrim(query,"."))
``` Ghost Overlay PIN-exfiltration receiver (GhostBat variant) ```
| where q="api.cloudsettle.org" OR like(q,"%.cloudsettle.org") OR q="cloudsettle.org"
| stats count min(_time) as first_seen max(_time) as last_seen values(q) as queried values(answer) as resolved_ips by src_ip
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen src_ip queried resolved_ips count

Microsoft KQL

DnsEvents
| where TimeGenerated > ago(24h)
| extend NameL = tolower(trim_end("[.]", Name))
// Ghost Overlay PIN-exfiltration receiver (GhostBat variant)
| where NameL == "cloudsettle.org" or NameL endswith ".cloudsettle.org"
| summarize Queries = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), ResolvedIPs = make_set(IPAddresses, 20) by ClientIP, NameL

Sigma

title: GhostBat RAT DNS Query for Ghost Overlay Receiver api.cloudsettle.org
id: c82e5a14-7b39-4d60-9a2f-0e4d1b6c8f97
status: experimental
description: Detects DNS queries for api.cloudsettle.org, the Ghost Overlay stolen-PIN receiver used by the updated GhostBat RAT variant (TL-2026-5434).
references:
    - https://zimperium.com/blog/mobile-threat-watch/ghostbat-android-malware-targets-60-banking-and-payment-apps-in-india
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
    - attack.command_and_control
    - attack.t1437.001
    - attack.t1481
    - attack.exfiltration
    - attack.t1646
logsource:
    category: dns
detection:
    selection:
        query|endswith: 'cloudsettle.org'
    condition: selection
falsepositives:
    - Threat-intelligence sandbox or analyst lookups of the indicator
    - Unrelated legitimate sites on the cloudsettle.org parent domain, if any are found
level: high

Known false positives:

  • Threat-intelligence sandbox or analyst lookups of the indicator
  • Unrelated legitimate sites on the cloudsettle.org parent domain, if any are found

Tuning notes: Exclude analyst and sandbox sources. If your DNS logs show only the resolver address, enrich with DHCP or Wi-Fi controller data to find the real client. Also block the domain at DNS and proxy. The BeaconBeagle lookup for this domain failed, so treat it as unvalidated and review hits.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • GhostBat RAT - Android APK Download from GitHub-Hosted Repository by Mobile Client · unlock with TL Creds
  • GhostBat RAT - SMS/OTP Interception, USSD Forwarding and Miner Behaviour Alert · unlock with TL Creds
  • GhostBat RAT - Firebase Remote Config and Telegram Bot Beaconing from One Client · unlock with TL Creds
  • GhostBat RAT - Loader Artifacts [indicator], [indicator] and Sample SHA-256 on Endpoint · unlock with TL Creds
  • GhostBat RAT - Sideloaded App Masquerading as mParivahan/eChallan on Managed Device · unlock with TL Creds
  • GhostBat RAT - HTTPS POST Exfiltration to [indicator] or ghostx-panel Firebase Backend · unlock with TL Creds
  • GhostBat RAT - mParivahan/eChallan Traffic-Fine Lure Domain Requested by Mobile Client · unlock with TL Creds
  • GhostBat RAT - Accessibility Service plus Overlay Abuse Alert on Managed Android Device · unlock with TL Creds

Indicators of compromise for GhostBat RAT Ghost Overlay

As of 2026-11-06, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-5434.

Sample indicators (2 of 13)

  • Domain: api[.]cloudsettle[.]org
  • File hash: 98991cd9557116b7942925d9c96378b224ad12e2746ac383752b261c31e02a1f

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

13 indicators of compromise · unlock with TL Creds. Compare plans

How GhostBat RAT Ghost Overlay works

GhostBat was first documented by CRIL (Cyble) in July 2024 and resurfaced in September-October 2025 as an RTO (Regional Transport Office)-themed Android RAT impersonating the Indian government mParivahan app. Zimperium detected the campaign on 2025-09-29 and publicly disclosed zero-day coverage on 2025-10-31; Cyble reported more than 40 distinct samples. Victims receive WhatsApp or SMS messages with shortened URLs claiming an unpaid vehicle traffic fine. The links lead to fake Google Play pages, spoofed mParivahan/eChallan portals, GitHub-hosted APKs or compromised websites that deliver a malicious dropper.

The malware uses a multi-stage dropper design: a first-stage APK with heavy string obfuscation (strings stored as long numeric sequences), deliberate ZIP header manipulation, XOR-decrypted asset files, AES encryption with keys derived from SHA-1 hashes of filenames, a native .so library that builds API calls dynamically through JNI, and a three-stage deployment ending in DexClassLoader execution of modules held in a classes.zip container. The sample set terminates on x86/x86_64 architectures as an anti-emulation check, and VirusTotal detections were reported as low. The 2026 variant described by Cyble and SecurityOnline reports six loader approaches (encrypted APK containers, in-memory DEX loading, remote downloaders, multistage native unpacking via libnetbridge.so with an RC4-like transformation and AES-256-GCM decryption, and custom MSZ1/MSP1 containers) and a malicious split_config.dex.apk.

Functionally, GhostBat requests SMS and overlay permissions and Accessibility Service access. Once Accessibility is granted, it watches the foreground application and, when one of 60 targeted Indian financial apps (for example PhonePe, Paytm, BHIM, BharatPe, CRED, Google Pay, MobiKwik, SBI UPI, Axis Pay, Groww, Samsung Pay) is in a PIN-entry context, draws a transparent 'Ghost Overlay' grid. It reconstructs the PIN from taps and delete/confirm actions through accessibility events, so the user sees the genuine app UI. Other capabilities are banking credential phishing pages, collection of mobile numbers, vehicle details and UPI data, SMS exfiltration filtered on banking keywords, OTP harvesting through SMS forwarding, USSD call forwarding, and a cryptocurrency-mining library. Infected devices register through a Telegram bot (GhostBatRat_bot) and exfiltrate over HTTPS, Firebase services and a configurable WebSocket tunnel. The Ghost Overlay data receiver is api.cloudsettle.org, and settings are updated through Firebase Remote Config.

An exposed Firebase project named ghostx-panel, found while unpacking an mParivahan sample, held client records, admin accounts and bot-user mappings and ties the malware to a 'GhostX' operator ecosystem for phishing, device management, backend configuration and distribution. Independent researcher Karan Dhillon reportedly documented 641 compromised devices and 244 stolen UPI PINs across five related mParivahan Firebase databases in August 2026 (single secondary-source report). No named threat actor or nation-state attribution is stated in any source. Primary sources do not publish file hashes beyond one sample SHA-256, package names or IP addresses. A BeaconBeagle lookup for api.cloudsettle.org returned HTTP 502 and could not be completed.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1406.002 Obfuscated Files or Information: Software Packing; T1407 Download New Code at Runtime; T1655.001 Masquerading: Match Legitimate Name or Location

Credential Access

T1417.001 Input Capture: Keylogging; T1417.002 Input Capture: GUI Input Capture

Discovery

T1424 Process Discovery; T1426 System Information Discovery

Command and Control

T1437.001 Application Layer Protocol: Web Protocols; T1481 Web Service

Execution

T1575 Native API

Collection

T1636.004 Protected User Data: SMS Messages

Exfiltration

T1646 Exfiltration Over C2 Channel

Initial Access

T1660 Phishing

Remediation for GhostBat RAT Ghost Overlay

Immediate actions

  • Block api.cloudsettle.org at DNS/proxy and alert on any device contacting it
  • Hunt MDM/MTD telemetry for sideloaded APKs impersonating mParivahan, eChallan or RTO apps and for apps granted Accessibility Service plus overlay (SYSTEM_ALERT_WINDOW) permissions
  • Warn users that unsolicited WhatsApp/SMS traffic-fine messages and links to GitHub-hosted APKs or fake Google Play pages are fraudulent
  • If an infection is suspected, remove the app, change UPI PINs and banking credentials, and notify the bank

Workarounds

  • Disable 'Install unknown apps' for browsers and messaging apps
  • Review and revoke Accessibility Service grants for non-assistive apps

Longer-term hardening

  • Deploy mobile threat defense with on-device detection of Accessibility Service abuse, overlay attacks and dynamic DEX loading
  • Restrict app installation from unknown sources and enforce Google Play Protect on managed devices
  • Banking and payment apps should detect overlays and accessibility-service abuse during PIN entry (FLAG_SECURE, obscured-touch filtering)
  • Security-awareness training on government-service smishing

Affected and fixed versions

  • Google — Android (devices where a malicious app is granted Accessibility Service and overlay permissions)
    Vulnerable versions: Not version-specific; user-granted permission abuse
  • Multiple (Indian banks and UPI/wallet providers) — 60 targeted banking, UPI and payment apps incl. PhonePe, Paytm, BHIM, BharatPe, CRED, Google Pay, MobiKwik, SBI UPI, Axis Pay, Groww, Samsung Pay
    Vulnerable versions: All versions lacking overlay/accessibility protections

Timeline of GhostBat RAT Ghost Overlay

  • locked-ioc-9 first documented by CRIL (Cyble); exact day not stated, July 2024 per secondary reporting.
  • Zimperium detects the RTO-themed locked-ioc-9 campaign; Cyble later counts 40+ distinct samples from September 2025.
  • Cyble publishes 'locked-ioc-9: Inside the Resurgence of RTO-Themed Android Malware' covering fake locked-ioc-11 apps, Telegram bot registration, cryptomining and UPI PIN theft.
  • Zimperium publishes zero-day coverage of the locked-ioc-9 campaign (WhatsApp/SMS smishing, locked-ioc-5, native-library evasion).
  • Researcher Karan Dhillon reportedly documents 641 compromised devices and 244 stolen UPI PINs across five related locked-ioc-11 Firebase databases (August 2026; exact day not stated; single secondary source).
  • Updated GhostBat variant reported with Ghost Overlay targeting 60 Indian financial apps, six loader approaches, locked-ioc-2 and exposed locked-ioc-8 Firebase project.
  • Zimperium Mobile Threat Watch publishes 'GhostBat Android Malware Targets 60 Banking and Payment Apps in India'.

Sources cited for GhostBat RAT Ghost Overlay

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats