Cyble researchers have described an updated variant of the GhostBat Android remote access trojan that records and replays PIN taps inside Indian payment apps. The malware monitors 60 banking, UPI and payment apps, including Google Pay and MobiKwik, and spreads through text and WhatsApp messages claiming the recipient owes an unpaid traffic fine.
GhostBat Operates Inside the GhostX Cybercrime Framework
According to Cyble, the GhostBat variant operates within a wider cybercrime framework tracked as GhostX, which is believed to be sold as malware-as-a-service. Cyble does not attribute the activity to individual operators. The campaign start date was not stated in the coverage of the findings.
The Ghost Overlay: A Transparent Accessibility-Based PIN Recorder
The malware’s central feature is a transparent accessibility-based “Ghost Overlay.” The overlay records and replays PIN taps inside Google Pay and MobiKwik, which gives the operators the UPI PINs needed to authorize payments.
Other Capabilities: Keylogging, USSD Forwarding and SMS Interception
GhostBat also performs accessibility keylogging, USSD call forwarding and SMS interception, and it manages its configuration through Firebase Remote Config. Together these functions let the malware capture keystrokes, intercept messages that can carry one-time codes and manage its behavior remotely.
Scope: Android Users in India and 60 Targeted Apps
The targeted population is Android users in India. The 60 monitored apps are banking, UPI and payment applications, with Google Pay and MobiKwik named as the ones where the Ghost Overlay records and replays PIN taps. Cyble believes the GhostX framework is sold as malware-as-a-service.
Delivery Through Fake Traffic Fine Alerts
The infection chain starts with smishing. Victims receive SMS or WhatsApp messages claiming they have an unpaid traffic fine. The links lead to fake Google Play pages or to spoofed mParivahan and eChallan government portals.
Installers Hosted on Public GitHub Repositories
The installers are hosted on public GitHub repositories, a choice Cyble says is meant to dodge domain blocks. Hosting on a widely used code platform means the download address does not sit on a newly registered domain that blocklists would flag.
Earlier Firebase Clusters: 641 Devices and 244 UPI PINs
Related Firebase clusters from earlier research documented 641 compromised devices and 244 stolen UPI PINs. Indian state police advisories were cited as a source in the coverage. Those figures come from earlier work, and they show what the same infrastructure family had achieved before the updated variant.
The impact of the campaign is direct: theft of UPI PINs enables unauthorized payments from victims’ accounts. The combination of PIN capture, SMS interception and USSD call forwarding gives operators several routes to confirm and receive transactions without the victim’s involvement.
Guidance for Users
The advice for the public is short and addresses the delivery step rather than the malware itself.
The recommended response for users is to avoid installing apps from links in SMS or WhatsApp messages and to verify traffic fines through official portals. Because the lure impersonates the mParivahan and eChallan portals, the official government sites are the only reliable place to check whether a fine exists.
The campaign relies on a decision by the recipient to open a link and approve an installation from outside the official store. The use of a traffic-fine pretext shows how the operators tie the lure to a government service that Indian users expect to receive official notices from. Cyble has not reported how many devices the updated variant has infected, and the number of operators using GhostX is unknown, which leaves the full reach of the malware-as-a-service model unmeasured.
The Cyble report also leaves open how widely the updated variant has spread. The only victim figures come from the earlier Firebase clusters, which documented 641 compromised devices and 244 stolen UPI PINs, and no comparable count has been given for the current GhostBat variant. The installers themselves sit on public GitHub repositories.
