GhostBat Android Malware Targets 60 Banking and UPI Apps in India

A new variant of the GhostBat Android malware is targeting users of 60 banking, UPI, wallet, and fintech applications in India, according to a report by Cyber Security News. This campaign represents an evolution of the threat, moving beyond simple SMS interception to actively monitoring and capturing sensitive financial inputs within legitimate applications.

Cyble analysts identified these new capabilities while investigating a broader operation they have labeled GhostX. The researchers stated that they have been tracking GhostBat activity in India since October 2025. Their investigation revealed connections between the malware, fraudulent government-service applications, phishing websites, and a backend system controlled by the operators.

Distribution and Initial Access

The attack chain begins with smishing, where victims receive SMS or messaging-app messages posing as traffic fines or government service notices. These messages contain links that direct users to fake mParivahan or eChallan pages, or to screens mimicking the Google Play Store. Victims are then urged to install an APK file outside the official app store.

Cyble also discovered that malicious APKs were being shared through public GitHub repositories and hosted files. This distribution method builds on earlier GhostBat campaigns that used fake RTO apps to steal banking data and read SMS messages, including one-time passwords. Similar fake challan lures have previously been used to spread other Android malware.

Technical Capabilities and Targeting

Once installed, GhostBat may request sensitive permissions, including access to the Android Accessibility Service. While this feature is designed to assist users with disabilities, the malware misuses it to read screen content and interact with applications. If a victim grants this access, the malware can determine which app is currently open.

The malware compares the active application against a list of financial apps selected by its operators. Cyble identified a feature called Ghost Overlay, which specifically targets Google Pay and MobiKwik. Instead of displaying a fake payment screen, the malware places transparent touch areas over the PIN keypad in the genuine application. This allows the operators to capture PIN-like input directly from the real app.

What should you do?

Users should remain vigilant against unsolicited messages claiming to be from government services or traffic authorities. Installing applications from sources outside the official Google Play Store significantly increases the risk of malware infection. Granting Accessibility Service permissions to unknown or suspicious applications can expose sensitive data and screen activity to malicious actors.

What to do and how to stay safe: GhostBat

• Avoid clicking links in SMS or messaging apps that claim to be traffic fines or government notices.
• Only install applications from the official Google Play Store to reduce the risk of malicious APKs.
• Review Accessibility Service permissions regularly and revoke access for any apps that do not require it.
• Monitor financial apps for unexpected behavior or transparent overlays that may indicate malware activity.

Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is GhostBat malware?

GhostBat is an Android malware that abuses Accessibility Services to monitor apps and capture PIN inputs, according to Cyble researchers.

How is GhostBat distributed?

It is spread through fake mParivahan and eChallan messages that trick users into installing harmful APKs outside official stores.

Which apps are targeted by GhostBat?

The malware targets 60 banking, UPI, wallet, fintech, and payment apps in India, including Google Pay and MobiKwik.