GhostBat Android Malware Targets 60 Indian Banking Apps with Sophisticated PIN Stealing
A new variant of the GhostBat Android malware is targeting 60 Indian banking and payment applications, employing novel techniques to steal PINs and other sensitive information.
A new iteration of the GhostBat Android malware has emerged, specifically targeting users of 60 banking, UPI, wallet, fintech, and payment applications across India. This sophisticated malware leverages Android's Accessibility Service to monitor user activity within targeted applications and capture PIN inputs. The campaign is notably distributed through smishing (SMS phishing) tactics, utilizing deceptive messages that mimic traffic fine notices or government service alerts to trick users into downloading malicious APK files outside of official app stores.
Researchers from Cyble, who are tracking the broader operation as GhostX, identified the malware's enhanced capabilities. Beyond its previous functionality of stealing SMS messages, the latest GhostBat variant can also collect call logs, receive remote commands from its operators, and dynamically alter its configuration post-installation. This expanded feature set poses a significant risk to financial app users, as it can compromise credentials even when users interact with legitimate applications.
The infection chain begins with smishing messages containing links that lead to fake government service portals or simulated Google Play download pages. Users are then prompted to install an APK file, bypassing standard security checks. Malicious APKs have also been found distributed through public GitHub repositories and other file-hosting services, broadening the attack vectors.
Once installed, GhostBat requests sensitive permissions, most critically, Accessibility Service access. This feature, designed for user assistance, is abused by the malware to read screen content and interact with applications. The malware maintains a list of targeted financial apps and can employ a technique called "Ghost Overlay." For specific apps like Google Pay and MobiKwik, it overlays transparent touch areas on the genuine PIN keypad, recording the digits entered by the user while the payment app proceeds normally. This allows attackers to capture PINs without the user necessarily noticing an altered interface.
In addition to the overlay method, GhostBat can capture PIN-like input across a wider range of 60 targeted applications by analyzing Accessibility events and screen context. The list of affected applications includes prominent services such as Google Pay, PhonePe, Paytm, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge, and PayZapp, among others.
The malware's capabilities extend to call-forwarding controls and remote SMS management, providing operators with multiple avenues to monitor compromised devices and facilitate financial fraud. To evade detection, the malware employs various loader and dropper types, including encrypted containers and custom payload formats. The latest samples utilize a native library, libnetbridge.so, and a complex chain of encryption and compression stages to obfuscate the final payload, making it difficult for basic security scanners to analyze.
Furthermore, GhostBat utilizes Firebase Remote Config to remotely update its settings, including command-and-control (C2) server addresses. This allows operators to adapt their infrastructure without needing to distribute new malware versions, enhancing the campaign's resilience and longevity. The observed Firebase project andromeda-d389d and a configurable base_url value are key indicators of this remote management capability.
Security experts advise users to install applications only from trusted sources, exercise caution with links received via SMS or messaging apps, and carefully review app permissions before granting access. Keeping Android devices and applications updated, along with promptly contacting banks if suspicious activity is detected, are crucial mitigation steps. Reporting suspicious messages and considering credential resets or device resets are also recommended when infection is suspected.