GhostBat RAT Android Malware Targets Indian Users with Fake RTO Apps and Telegram Bot C2

GhostBat RAT is an Android malware campaign uncovered by Cyble Research and Intelligence Labs (CRIL) that targets Indian users by impersonating official RTO apps and using phishing, Telegram bot C2, and cryptocurrency mining modules to exfiltrate financial data. The campaign spreads via WhatsApp messages and SMS containing shortened URLs that lead to GitHub-hosted APKs or compromised websites, and once installed the malware prompts fake update screens and phishing pages mimicking mParivahan.

CRIL explained that the infections rely on native libraries and multi-stage droppers, with more than 40 distinct Android samples identified between September 2025 and now, designed to evade detection through heavy string obfuscation and encrypted payloads. A notable aspect is that every infected device is automatically registered with a Telegram bot named GhostBatRat_bot, providing the attackers with real-time monitoring and a C2 infrastructure hosted on encrypted messaging platforms.

After installation, the fake RTO app asks users to pay ₹1 to verify vehicle ownership, then presents a counterfeit UPI interface and a fake PIN page, with the PIN submitted forwarded to a Firebase endpoint. The campaign also exfiltrates SMS messages containing bank-related keywords and OTPs to facilitate unauthorised transactions, while the modular architecture indicates evolving Android malware trends. 15 October 2025.