GhostBat RAT Android Malware Poses as Fake RTO Apps to Steal Banking Data from Indian Users

GhostBat RAT Android malware campaigns pose as fake Regional Transport Office (RTO) apps to steal banking data, with observations dating from July 2024 when CRIL first documented Android malware masquerading as RTO applications designed to steal contacts and SMS messages. According to CRIL, renewed observations from September 2025 onward show over forty distinct samples propagating through WhatsApp image shares and SMS messages containing shortened URLs that redirect to GitHub hosted APKs.

The threat actors employ multi‑stage dropper workflows, ZIP header manipulation, and heavy string obfuscation to evade antivirus detection and reverse engineering, with a native loader using .so libraries to dynamically resolve API calls and deploy a credential stealer alongside a cryptocurrency miner.

Victims are presented with phishing pages mimicking the mParivahan app, prompting for mobile numbers, vehicle details, and UPI payments, while all SMS containing banking keywords are exfiltrated to C&C servers and incoming messages may be forwarded for OTP harvesting. The campaign registers compromised devices via the Telegram bot GhostBatRat_bot, cementing the GhostBat RAT moniker.

Upon installation, users are led through a fake Google Play update flow that triggers the malicious APK, and the malware ultimately harvests both static banking credentials and dynamic OTPs to facilitate unauthorised transactions.