A newly uncovered strain of Android malware named GhostBat is actively going after users of 60 popular banking, UPI, wallet, and payment apps across India. Rather than just stealing SMS messages, this version escalates its tactics significantly by abusing Android’s Accessibility Service to monitor specific apps and harvest PIN inputs—even while real apps are in use.
Malicious Delivery & Deceptive Entry Points
The attack chain kicks off with smishing—SMS or messaging app notifications masquerading as official government services, such as eChallan or mParivahan, inviting users to click links. These lead to malicious APKs hosted outside Google Play, impersonated Play Store pages, or files shared via public GitHub repositories. Victims are tricked into installing software that looks legitimate but serves nefarious ends.
Once installed, the malware requests Permission to use Android’s Accessibility Service. This privileged access allows it to watch which apps are active, especially financial ones, and act upon them based on predefined behaviors controlled by the malware operators.
How GhostBat Steals PINs & Stealthily Operates
GhostBat includes a feature called “Ghost Overlay” which deploys transparent touch zones over elements like PIN keypads in apps such as Google Pay and MobiKwik. When a user taps their PIN, the overlay catches it, then silently plays back those taps into the real app so it continues as expected—while the attacker captures sensitive information.
Beyond overlays, the malware tracks Accessibility events and screen context to detect input of PIN-like codes across all 60 targeted apps. It also steals SMS messages, including OTPs (one-time passwords), gathers call logs, SIM info, and even tweaks settings or forwards calls—all to support financial fraud.
Evasion Techniques & Adaptive Infrastructure
GhostBat’s developers employ multiple obfuscation layers to slip past detection. They use various loader or dropper formats, including encrypted APK containers, in-memory DEX loading, custom payloads, and dynamic native libraries like libnetbridge.so. These layers—along with encryption, compression, and remote APK downloads—make it difficult for basic security tools to spot the threat.
Another sophisticated addition: integration with Firebase Remote Config. Through remote settings—like the Firebase projects andromeda-d389dand ghostx-panel—operators can swap features, modify backends, or adjust operations without pushing new app versions.
The malware specifies multiple “command-and-control” infrastructure points, including the domain api.cloudsettle.org(defanged for safety), endpoints for PIN data exfiltration, and the overlay packages like com.mobikwik_newand com.google.android.apps.nbu.paisa.
Protection Tips & What to Watch For
Users should avoid installing APKs from unexpected links or text messages, especially when urged to impersonate government services. Be wary of apps requesting broad access like Accessibility, SMS or notifications unless they need such permissions. Regularly updating Android OS and apps helps patch vulnerabilities. If you suspect compromise, act fast—change credentials, contact your bank, or even reset your device.
One central danger is the overlay attack: even when you’re using legit payment apps, GhostBat captures your PIN in the background without displaying a fake login screen. Combined with deceptive lures, remote configuration, and dynamic backends, this campaign is built for stealth and adaptability.
GhostBat shows a clear evolution from earlier threats. Previously limited to stealing SMS or faking RTO apps to gather banking data, today’s version can overlay PIN inputs and control activities across real financial apps—making detection much harder.
This shift represents a leap in Android malware threat complexity. As attackers use overlays, misuse system services like Accessibility, and employ remote-controlled infrastructures, users and security providers both face new challenges. The line between legitimate and malicious behavior blurs. Moving forward, stronger vetting of app permissions, tighter policy enforcement on app store governance, and improved awareness among users will be key in preventing campaigns like GhostBat from causing widespread financial damage.
