A new GhostBat variant uses Android’s Accessibility Service to record PIN taps inside legitimate payment apps, while traffic-fine smishing campaigns deliver the malware.
Cybersecurity researchers have detailed a new Android banking malware variant that is now aimed at 60 financial app packages used in India, marking an evolution in the GhostBat family from crude phishing screens to a more subtle method that captures payment PINs inside legitimate apps. Cyble said the latest strain uses a technique it calls Ghost Overlay, which relies on Android’s Accessibility Service to watch for the right moment to intercept a user’s input while a genuine payment app is open.
The new approach is designed to look and feel less suspicious than earlier GhostBat campaigns. Instead of forcing victims through counterfeit payment pages, the malware places transparent touch regions over the real keypad in apps such as Google Pay and MobiKwik, then records which digit is tapped. Cyble said the malware temporarily releases each covered area and replays the touch inside the legitimate app, while also tracking delete and confirm actions so it can reconstruct a full PIN sequence.
This latest discovery builds on Cyble’s October investigation into GhostBat, which found the malware spreading through fraudulent mParivahan apps, stealing banking messages and harvesting UPI PINs through fake payment pages. According to Cyble, the campaign continues to rely on smishing lures tied to traffic fines, vehicle registration and other government-themed messages, with malicious APKs delivered through deceptive download sites and GitHub-hosted files.
The broader operation appears more sophisticated than a single malware sample. Cyble said it uncovered a Firebase project identifier linked to a GhostX backend, along with client records, administrator accounts, bot-user mappings and device data. Those findings suggest an operator-managed infrastructure that can alter targets, campaign details and command settings without redistributing the app, although Cyble stopped short of confirming a formal malware-as-a-service business model.
Researchers also identified at least six loader methods used to conceal the payload, including encrypted containers, in-memory DEX loading and multi-stage native unpacking. In the newest loader, libnetbridge.so, the malware reportedly uses several layers of protection, including RC4-like processing, AES-256-GCM decryption and zlib decompression, before extracting the malicious code. That added complexity makes the software harder to inspect and easier to adapt.
Cyble said captured PINs are stored locally before being sent to attacker-controlled infrastructure, including an endpoint at /pin-data and a server identified as api.cloudsettle[.]org. The company advised users to avoid installing APKs prompted by unsolicited traffic-fine messages, to rely on official app stores and government sources, and to review permission requests closely, especially if an app asks for Accessibility Service access.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
