GhostBat RAT Uses Android Accessibility Overlays to Steal PINs
Summary
Cyble reports that GhostBat RAT targets Android users in India through mParivahan- and eChallan-themed campaigns. Its latest variant uses Accessibility Service overlays to capture financial-app PINs and Firebase Remote Config to manage malware capabilities and C2.
Key points
- Cyble links smishing campaigns impersonating India’s mParivahan and eChallan services to malicious Android APKs distributed through phishing pages and public GitHub-hosted assets.
- Analysis of an exposed Firebase backend revealed GhostX, an operator-controlled ecosystem with device-management, user and administrator records, and changing phishing and SMS content.
- The latest GhostBat RAT variant uses Android Accessibility Service to place transparent overlays over legitimate Google Pay and MobiKwik PIN keypads, capture touch input, and replay taps into the apps.
- A separate accessibility-based input-capture capability targets 60 banking, UPI, wallet, fintech, and payment applications, according to Cyble.
- Cyble identified at least six loader or dropper implementations; the newest uses libnetbridge.so and multiple transformation, encryption, and compression stages to recover the payload.
- Firebase Remote Config allows operators to change the malware’s backend address and selectively enable capabilities without redistributing the APK.
- The malware also collects SMS and call-log data and supports remote SMS transmission and call-forwarding manipulation.
Article Details
- Attack Vectors
- Smishing messages link to phishing pages impersonating mParivahan, eChallan, or a Google Play-style download page, which distribute fraudulent APKs.
- GhostBat RAT uses multiple loader and dropper mechanisms to conceal or retrieve its payload, including a variant that downloads and installs a second-stage APK.
- After installation, GhostBat RAT abuses Android Accessibility Service to capture PIN and key input, including transparent overlay interception in Google Pay and MobiKwik.
- GhostBat RAT collects SMS messages and call logs, can send attacker-defined SMS messages, and can manipulate call forwarding.
- Defensive Notes
- Install apps only from trusted sources and avoid app-install links received by SMS, social media, or email.
- Verify URLs and avoid suspicious websites requesting sensitive information; check app legitimacy before granting permissions or installing it.
- Enable multi-factor authentication for banking and financial apps.
- Keep Android and apps updated, and use a mobile security solution with real-time scanning.
- If infection or targeting is suspected, report it to the bank and local authorities; reset credentials and perform a factory reset if necessary.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//api[.]cloudsettle[.]org | Default HTTPS C2 backend configured in the analyzed GhostBat RAT sample. |
| URL | hxxps[:]//api[.]cloudsettle[.]org/pin-data | GhostBat RAT C2 endpoint used to exfiltrate captured PIN data. |
MITRE ATT&CK
T1406.002GhostBat RAT conceals payloads with encrypted and packed loaders, including AES-CBC, XOR, SPKZ/SPK1, encrypted DEX stages, and the multi-stage libnetbridge.so loader.T1407One delivery variant downloads a second-stage APK from remote infrastructure, validates its SHA-256 hash, and installs it.T1417.001Accessibility Service events are used to capture PIN and key input across a configured set of 60 banking, UPI, wallet, fintech, and payment apps.T1417.002Selected GhostBat RAT variants use fraudulent payment interfaces to capture UPI PINs, payment-card details, and other financial information.T1437.001GhostBat RAT communicates with its backend through HTTPS REST APIs and uses Firebase Cloud Messaging for command delivery; the latest variant also supports a configurable secure WebSocket channel.T1453The latest variant abuses Android Accessibility Service to monitor targeted financial apps, identify PIN-entry contexts, and capture input.T1516GhostBat RAT uses AccessibilityService.dispatchGesture() to replay PIN-keypad touches into the legitimate Google Pay and MobiKwik applications after intercepting them.T1517The article reports that selected GhostBat RAT variants register a notification-listener service to monitor other apps' notifications, including potentially sensitive OTPs.T1582GhostBat RAT can receive attacker-defined SMS jobs and send messages using the infected device's SIM.T1616GhostBat RAT uses USSD-based operations to manipulate or query call forwarding and report its status to C2.T1624.001The article reports that a boot-triggered Broadcast Receiver restarts GhostBat RAT services and workers after device reboot.T1636.002GhostBat RAT collects historical and newly observed call-log records and uploads them to its C2 infrastructure.T1636.004GhostBat RAT collects historical SMS messages and monitors newly received messages, including OTPs and banking alerts.T1655.001GhostBat RAT masquerades as legitimate mParivahan and eChallan applications using government-themed names, icons, and interfaces.T1660GhostBat RAT is distributed through smishing links that redirect victims to fake mParivahan, eChallan, or Google Play-style pages serving the malicious APK.
Malware
Products
AndroidCyble has continued tracking GhostBat RAT activity targeting Android users in India since its initial identification in October 2025.eChallanRecent investigations into malicious mParivahan and eChallan-themed applications revealed a broader operator-controlled ecosystem that we track as GhostX.Firebase Remote ConfigFirebase Remote Config further enables operators to dynamically modify C&C infrastructure and malware functionality after installation.Google PayGhost Overlay transparently intercepts PIN keypad interactions in Google Pay and MobiKwik.MobiKwikGhost Overlay transparently intercepts PIN keypad interactions in Google Pay and MobiKwik.mParivahanRecent investigations into malicious mParivahan and eChallan-themed applications revealed a broader operator-controlled ecosystem that we track as GhostX.