GhostBat RAT Evolves to Steal UPI PINs via Fake Traffic Challan Texts in India

Cybersecurity firm Cyble reports that the GhostBat remote access trojan has evolved to capture sensitive credentials from a wide range of financial applications on Android devices. The updated malware strain can now steal personal identification numbers from sixty distinct banking, unified payments interface, digital wallet and financial technology applications, significantly expanding its financial theft capabilities.

This development follows Cyble’s initial identification of the GhostBat RAT in October 2025. The firm’s latest research details how the malware has adapted to target the digital payments ecosystem, moving beyond its earlier capabilities to extract high-value authentication data directly from users’ mobile devices.

Distribution and Evasion Tactics

The primary distribution channel for this malware is smishing, or SMS phishing, where victims receive text messages claiming they have unpaid traffic challans or fines. These messages contain malicious links that direct users to web pages impersonating the official Parivahan government service or Google Play Store download interfaces. Users are then prompted to install a fraudulent application package for the mParivahan service, which serves as the entry point for the infection.

To avoid detection, many of the distributed applications act only as initial loaders. The actual malicious payload remains hidden within encrypted files or is downloaded remotely after the initial installation. This technique allows the app to appear benign during preliminary security scans, as the harmful components are not present in the file structure at the time of the first analysis.

Cyble researchers also identified that attackers frequently use GitHub repositories to host these malicious files. By leveraging a platform known for legitimate software development, the operators can distribute the malware more effectively while potentially obscuring the source of the attack from casual observers and automated security tools.

The GhostX Ecosystem

The investigation into the fake mParivahan and eChallan applications revealed a broader operator-controlled infrastructure that Cyble tracks under the name GhostX. This ecosystem connects various components of the attack, including phishing web pages, backend command-and-control systems and the malware distribution channels. The findings suggest a coordinated effort to manage the entire lifecycle of the attack, from initial victim contact to credential harvesting.

As Threat Times reported on 2026-10-15, Google has rolled out new Android security features designed to block mobile fraud, including enhanced protections for messages and call forwarding. The GhostBat campaign highlights the ongoing challenge of securing mobile devices against sophisticated social engineering tactics that exploit user trust in government services and legitimate app stores.

What should you do?

Security professionals should monitor for unusual SMS activity and educate users about the risks of clicking links in unsolicited messages, particularly those related to government fines or legal notices. Organizations with employees in India should ensure their mobile device management policies restrict the installation of applications from unknown sources and enforce strict app vetting procedures.

Background: Social engineering

Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.

Read the full guide: Social Engineering Warning Signs and How to Respond

What to do and how to stay safe: GhostBat

• Verify any traffic challan or fine notices directly through official government websites or apps rather than clicking links in text messages.
• Avoid installing Android application packages from sources other than the official Google Play Store to prevent loader-based malware infections.
• Monitor mobile device logs for unexpected network connections or new applications that may indicate a hidden payload has been downloaded.
• Enable multi-factor authentication on all financial accounts to add an additional layer of security even if a PIN is compromised.

Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How does GhostBat RAT steal credentials from Android devices?

It uses smishing campaigns to trick users into installing fake apps that capture PINs from banking and fintech applications.

What is the GhostX ecosystem?

GhostX is the operator-controlled infrastructure linking phishing pages, backend control systems and malware distribution for the GhostBat campaign.

How do attackers hide the malware from security scans?

They use initial loader apps that download the actual malicious payload later or keep it encrypted, making the initial file appear harmless.