# GhostBat Android Banking Malware Targets 60 Banking and Payment Apps in India

> GhostBat (GhostBat RAT) is an Android malware family that abuses Accessibility Services to steal UPI/payment PINs via a transparent 'Ghost Overlay' and to intercept SMS/OTP messages. The updated variant targets 60 Indian banking, UPI and wallet apps and is spread through fraudulent mParivahan/eChallan traffic-fine smishing and malicious app downloads.

- **Published:** 2026-11-06T17:42:04Z
- **Last reviewed:** 2026-11-06T17:42:04Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5434
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5434.png
- **ID:** TL-2026-5434
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 13 (2 shown free below)

## Description

GhostBat was first documented by CRIL (Cyble) in July 2024 and resurfaced in September-October 2025 as an RTO (Regional Transport Office)-themed Android RAT impersonating the Indian government mParivahan app. Zimperium detected the campaign on 2025-09-29 and publicly disclosed zero-day coverage on 2025-10-31; Cyble reported more than 40 distinct samples. Victims receive WhatsApp or SMS messages with shortened URLs claiming an unpaid vehicle traffic fine. The links lead to fake Google Play pages, spoofed mParivahan/eChallan portals, GitHub-hosted APKs or compromised websites that deliver a malicious dropper.

The malware uses a multi-stage dropper design: a first-stage APK with heavy string obfuscation (strings stored as long numeric sequences), deliberate ZIP header manipulation, XOR-decrypted asset files, AES encryption with keys derived from SHA-1 hashes of filenames, a native .so library that builds API calls dynamically through JNI, and a three-stage deployment ending in DexClassLoader execution of modules held in a classes.zip container. The sample set terminates on x86/x86_64 architectures as an anti-emulation check, and VirusTotal detections were reported as low. The 2026 variant described by Cyble and SecurityOnline reports six loader approaches (encrypted APK containers, in-memory DEX loading, remote downloaders, multistage native unpacking via libnetbridge.so with an RC4-like transformation and AES-256-GCM decryption, and custom MSZ1/MSP1 containers) and a malicious split_config.dex.apk.

Functionally, GhostBat requests SMS and overlay permissions and Accessibility Service access. Once Accessibility is granted, it watches the foreground application and, when one of 60 targeted Indian financial apps (for example PhonePe, Paytm, BHIM, BharatPe, CRED, Google Pay, MobiKwik, SBI UPI, Axis Pay, Groww, Samsung Pay) is in a PIN-entry context, draws a transparent 'Ghost Overlay' grid. It reconstructs the PIN from taps and delete/confirm actions through accessibility events, so the user sees the genuine app UI. Other capabilities are banking credential phishing pages, collection of mobile numbers, vehicle details and UPI data, SMS exfiltration filtered on banking keywords, OTP harvesting through SMS forwarding, USSD call forwarding, and a cryptocurrency-mining library. Infected devices register through a Telegram bot (GhostBatRat_bot) and exfiltrate over HTTPS, Firebase services and a configurable WebSocket tunnel. The Ghost Overlay data receiver is api.cloudsettle.org, and settings are updated through Firebase Remote Config.

An exposed Firebase project named ghostx-panel, found while unpacking an mParivahan sample, held client records, admin accounts and bot-user mappings and ties the malware to a 'GhostX' operator ecosystem for phishing, device management, backend configuration and distribution. Independent researcher Karan Dhillon reportedly documented 641 compromised devices and 244 stolen UPI PINs across five related mParivahan Firebase databases in August 2026 (single secondary-source report). No named threat actor or nation-state attribution is stated in any source. Primary sources do not publish file hashes beyond one sample SHA-256, package names or IP addresses. A BeaconBeagle lookup for api.cloudsettle.org returned HTTP 502 and could not be completed.

## MITRE ATT&CK

- T1660 Phishing
- T1655.001 Masquerading: Match Legitimate Name or Location
- T1406.002 Obfuscated Files or Information: Software Packing
- T1407 Download New Code at Runtime
- T1575 Native API
- T1417.002 Input Capture: GUI Input Capture
- T1417.001 Input Capture: Keylogging
- T1636.004 Protected User Data: SMS Messages
- T1424 Process Discovery
- T1426 System Information Discovery
- T1437.001 Application Layer Protocol: Web Protocols
- T1481 Web Service
- T1646 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**GhostBat RAT - DNS Resolution of Ghost Overlay Receiver api.cloudsettle.org** (`TL-2026-5434-SPL-003`)

Detects any DNS lookup of api.cloudsettle.org or its subdomains, the Ghost Overlay data receiver to which the updated GhostBat variant (TL-2026-5434) exfiltrates stolen UPI PINs. A hit on a mobile or BYOD client indicates a likely infected device.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1437.001, T1481, T1646
- **Data sources:** stream:dns (index=network), DnsEvents (Microsoft Sentinel DNS), dns logsource (Sigma)
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
index=network sourcetype="stream:dns" earliest=-24h
| eval q=lower(rtrim(query,"."))
``` Ghost Overlay PIN-exfiltration receiver (GhostBat variant) ```
| where q="api.cloudsettle.org" OR like(q,"%.cloudsettle.org") OR q="cloudsettle.org"
| stats count min(_time) as first_seen max(_time) as last_seen values(q) as queried values(answer) as resolved_ips by src_ip
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen src_ip queried resolved_ips count
````

### Microsoft KQL

```kql
DnsEvents
| where TimeGenerated > ago(24h)
| extend NameL = tolower(trim_end("[.]", Name))
// Ghost Overlay PIN-exfiltration receiver (GhostBat variant)
| where NameL == "cloudsettle.org" or NameL endswith ".cloudsettle.org"
| summarize Queries = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), ResolvedIPs = make_set(IPAddresses, 20) by ClientIP, NameL
```

### Sigma

```yaml
title: GhostBat RAT DNS Query for Ghost Overlay Receiver api.cloudsettle.org
id: c82e5a14-7b39-4d60-9a2f-0e4d1b6c8f97
status: experimental
description: Detects DNS queries for api.cloudsettle.org, the Ghost Overlay stolen-PIN receiver used by the updated GhostBat RAT variant (TL-2026-5434).
references:
    - https://zimperium.com/blog/mobile-threat-watch/ghostbat-android-malware-targets-60-banking-and-payment-apps-in-india
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
    - attack.command_and_control
    - attack.t1437.001
    - attack.t1481
    - attack.exfiltration
    - attack.t1646
logsource:
    category: dns
detection:
    selection:
        query|endswith: 'cloudsettle.org'
    condition: selection
falsepositives:
    - Threat-intelligence sandbox or analyst lookups of the indicator
    - Unrelated legitimate sites on the cloudsettle.org parent domain, if any are found
level: high
```

**Known false positives:**

- Threat-intelligence sandbox or analyst lookups of the indicator
- Unrelated legitimate sites on the cloudsettle.org parent domain, if any are found

**Tuning notes:** Exclude analyst and sandbox sources. If your DNS logs show only the resolver address, enrich with DHCP or Wi-Fi controller data to find the real client. Also block the domain at DNS and proxy. The BeaconBeagle lookup for this domain failed, so treat it as unvalidated and review hits.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- GhostBat RAT - Android APK Download from GitHub-Hosted Repository by Mobile Client (locked: unlock with TL Creds)
- GhostBat RAT - SMS/OTP Interception, USSD Forwarding and Miner Behaviour Alert (locked: unlock with TL Creds)
- GhostBat RAT - Firebase Remote Config and Telegram Bot Beaconing from One Client (locked: unlock with TL Creds)
- GhostBat RAT - Loader Artifacts [indicator], [indicator] and Sample SHA-256 on Endpoint (locked: unlock with TL Creds)
- GhostBat RAT - Sideloaded App Masquerading as mParivahan/eChallan on Managed Device (locked: unlock with TL Creds)
- GhostBat RAT - HTTPS POST Exfiltration to [indicator] or ghostx-panel Firebase Backend (locked: unlock with TL Creds)
- GhostBat RAT - mParivahan/eChallan Traffic-Fine Lure Domain Requested by Mobile Client (locked: unlock with TL Creds)
- GhostBat RAT - Accessibility Service plus Overlay Abuse Alert on Managed Android Device (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 13)

Defanged, TLP:CLEAR.

- Domain: `api[.]cloudsettle[.]org`
- File hash: `98991cd9557116b7942925d9c96378b224ad12e2746ac383752b261c31e02a1f`

Full set of 13 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [GhostBat Android Malware Targets 60 Banking and Payment Apps in India (Zimperium Mobile Threat Watch)](https://zimperium.com/blog/mobile-threat-watch/ghostbat-android-malware-targets-60-banking-and-payment-apps-in-india)
- [Rapid Response: Zimperium's Zero-Day Coverage of GhostBat RAT Campaign](https://zimperium.com/blog/rapid-response-zimperiums-zero-day-coverage-of-ghostbat-rat-campaign)
- [GhostBat RAT: Inside the Resurgence of RTO-Themed Android Malware (Cyble)](https://cyble.com/blog/ghostbat-rat-inside-the-resurgence-of-rto-themed-android-malware/)
- [GhostBat RAT Android analysis (Cyber Security News)](https://gbhackers.com/ghostbat-rat-android/amp/)
- [GhostBat Android Malware (Cyber Security News)](https://gbhackers.com/ghostbat-android-malware/amp/)
- [GhostBat RAT Infection Chain / Ghost Overlay (SecurityOnline)](https://securityonline.info/ghostbat-rat-android-ghostx-overlay/)
- [GhostBat RAT Malware Targets Indian Users Through Fake RTO Apps (MobileIDWorld)](https://mobileidworld.com/ghostbat-rat-malware-targets-indian-users-through-fake-rto-apps/)
- [Reemergent GhostBat RAT malware targets India (SC Media)](https://www.scworld.com/brief/reemergent-ghostbat-rat-malware-targets-india)
- [GhostBat Android RAT Targets 60 Indian Banking and UPI Apps (Daily Security Review)](https://dailysecurityreview.com/?p=44676)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5434