Kiran 
Cyble’s latest research shows that GhostBat RAT, an Android banking trojan targeting users in India, has grown into a larger, operator-run ecosystem called GhostX.
Its newest variant captures payment PINs from the real Google Pay and MobiKwik keypads, with no fake login page. Cyble’s researchers have tracked the malware since October 2025.
The investigation began with fake mParivahan and eChallan apps found on phishing sites and public GitHub repositories. One “NextGen mParivahan” sample contained a Firebase project ID, ghostx-panel. Its exposed backend held tables for clients, bot users, admins, and admin logins.
GhostBat RAT Steals Google Pay, MobiKwik PINs
Those records included roles, account status, device fingerprints and session data. Cyble says this points to a multi-operator, service-style setup and raises the possibility of a Malware-as-a-Service model.
SMS lures, phishing URLs, vehicle numbers, and recipient numbers kept changing, so the campaign was clearly active. Victims receive a smishing text, often themed around a traffic challan.
The link leads to a fake Parivahan site or a Google Play-style page that pushes a fraudulent mParivahan APK. Attackers also host APKs on GitHub, which gives them free public infrastructure.
Many of these APKs are only first-stage loaders. Cyble found at least six loader types, including AES-CBC containers, SPKZ/SPK1 formats, in-memory DEX loaders, and a remote downloader.
The newest uses a native library, libnetbridge. so. It unpacks an encrypted asset through an RC4-like step, AES-256-GCM, zlib decompression, and a custom container. The result is a split APK. Detections that key on the outer APK or a single unpacking routine are therefore unlikely to last.
Once the victim grants Accessibility Service access, the malware watches which app is in the foreground. For Google Pay and MobiKwik, it overlays a transparent 12-region keypad grid on the real PIN pad. It records each tap, then uses dispatchGesture() to replay the same touch into the real app.
The payment flow looks normal, so the victim sees nothing wrong. Captured PINs are tagged “ghost_overlay” and queued for upload to the C&C at api[.]cloudsettle[.]org/pin-data.
A second mechanism captures PIN-like input across 60 Indian banking, UPI, wallet, and fintech apps. Those include PhonePe, Paytm, BHIM, CRED, Freecharge and Groww. The malware checks the app and screen context, and it applies configurable PIN-length limits.
Firebase Remote Config (project andromeda-d389d) lets operators change the base_url backend and switch modules on or off without redistributing the APK.
The api.cloudsettle.org address is therefore only the default. The C&C endpoints also cover SMS and call-log uploads, SIM data, call-forwarding status, and live keylog status.
Mitigation
- Install apps only from the Google Play Store, never from SMS links.
- Don’t grant Accessibility permissions to any app you can’t fully vouch for.
- Check URLs before entering any details.
- Turn on multi-factor authentication for banking and payment apps.
- Run a mobile security app with real-time scanning, and keep Android updated.
- If you suspect infection, tell your bank and the authorities right away. Reset your credentials and consider a factory reset.
Cyble says its CRIL team’s analysis has been selected for presentation at the Association of Anti-Virus Asia Researchers (AVAR) conference.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
1 thought on “GhostBat RAT Steals Google Pay, MobiKwik PINs Using Invisible Overlay in India Attacks”