A new GhostBat RAT variant targets 60 Android financial application packages used in India, combining accessibility-based PIN capture with a transparent overlay that intercepts interactions inside legitimate Google Pay and MobiKwik interfaces.
The findings extend Cyble’s October 2025 investigation, which documented GhostBat spreading through fraudulent mParivahan applications, harvesting banking messages, and stealing UPI PINs through counterfeit payment screens.
The latest variant moves beyond those phishing interfaces to capture input while victims use genuine financial applications.
GhostBat’s most distinctive addition, Ghost Overlay, requires victims to grant Android Accessibility Service access. Once enabled, the malware monitors foreground applications and identifies targeted PIN-entry contexts.
It then places 12 transparent touch regions over the genuine numeric keypad using Android’s TYPE_ACCESSIBILITY_OVERLAY window type.
When a victim selects a digit, the overlay intercepts the touch and maps its coordinates to a keypad value. GhostBat temporarily releases the affected overlay region and invokes AccessibilityService.dispatchGesture() to reproduce the tap inside the legitimate application.
Delete and confirmation actions are also tracked, allowing the malware to reconstruct completed PIN sequences without replacing the visible interface.
A separate accessibility-based capture mechanism extends targeting to 60 package identifiers associated with banking, UPI, wallet, fintech, and payment services.
These include PhonePe, Paytm, BHIM, BharatPe, CRED, and others. Unlike Ghost Overlay, this mechanism interprets accessibility events and interface context to reconstruct PIN-like input.
The target count represents configured packages, not evidence that every application was successfully compromised.
Captured PINs are queued locally through PinUploadWorker before transmission to the /pin-data endpoint.
Cyble identified api.cloudsettle[.]org as infrastructure receiving Ghost Overlay data, with captured records tagged to identify their collection source.
Cyble’s investigation connects the malware to GhostX, a broader operator-controlled ecosystem supporting phishing, device management, backend configuration, and malware distribution.
GhostBat Android Malware
Researchers uncovered the Firebase project identifier ghostx-panel while unpacking a malicious NextGen mParivahan sample.
Its exposed backend contained client records, administrator accounts, bot-user mappings, login timestamps, device fingerprints, and session-management data.
These structures distinguish GhostX’s operator-management ecosystem from GhostBat’s Android implant.
Repeated changes to SMS lures, phishing URLs, vehicle registration numbers, and recipient telephone numbers indicated ongoing campaign administration.
Distinct administrator and user roles suggest a multi-operator architecture, although Cyble described a Malware-as-a-Service operating model as a possibility rather than a confirmed commercial offering.
Delivery continues through mParivahan- and eChallan-themed smishing, with deceptive download pages and GitHub-hosted APKs.
Cyble identified at least six loader approaches, ranging from encrypted APK containers and in-memory DEX loading to remote downloaders and multistage native unpacking.
The newest loader, libnetbridge.so, processes an encrypted asset through an RC4-like transformation, AES-256-GCM decryption, zlib decompression, and custom MSZ1/MSP1 containers.
It ultimately recovers split APK components, with malicious executable code primarily inside split_config.dex.apk. These layers complicate static inspection and automated payload extraction.
Firebase Remote Config lets operators change command infrastructure, target packages, and selected capabilities without redistributing the APK.
The malware also combines HTTPS, Firebase services, and a configurable WebSocket tunnel for control.
Users should avoid APKs delivered through unsolicited traffic-fine messages, verify applications through official sources, and scrutinize permission requests. Suspected victims should promptly contact their bank and report the incident.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
