A new Android campaign impersonating India’s mParivahan and eChallan services uses hidden screen overlays and keylogging to target payment-app PINs.
Indian Android users are being targeted by a new GhostBat remote-access Trojan campaign that uses fake mParivahan and eChallan messages to lure people into installing malicious apps, according to cybersecurity researchers at Cyble. The operation appears designed to exploit trust in India’s transport and traffic-fine services, with victims redirected through smishing links to phishing pages that mimic official portals or Google Play-style download screens.
Cyble said the latest version goes beyond simple credential theft. On infected phones, it can place transparent overlays over payment-app PIN screens, allowing the attacker to capture taps without showing a fake keypad to the user. The technique has been observed against Google Pay and MobiKwik, while a wider keylogging function is said to harvest PIN entry across 60 banking, wallet, fintech and payments apps, including PhonePe, Paytm, BHIM, BharatPe, CRED and SBI UPI.
The researchers also described a broader operator-controlled ecosystem that they track as GhostX. Their analysis uncovered a Firebase project called “ghostx-panel” that appeared to support administration, device control, SMS delivery, call-forwarding activity and rapidly changing phishing content. Cyble also said the group can alter command-and-control infrastructure through Firebase Remote Config, and that it has identified at least six loader or dropper variants, including a newer native-library component called libnetbridge.so that uses multiple layers of encryption, compression and custom packaging before the final payload is restored.
The findings fit a wider pattern of mobile fraud in India, where attackers continue to lean on official-looking government and payment brands to pressure users into installing APK files outside trusted app stores. Cyble recommends that users avoid opening app-install links received by text message, download software only from the Google Play Store, and turn on multi-factor authentication wherever possible. The company also advises caution around app permissions and any request to approve updates through a message link rather than through an established app marketplace.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
