CYBLE Research and Intelligence Labs, along with independent researcher Karan Dhillon and Indian police advisories, have documented a new Android campaign attributed to GhostBat RAT operating within the broader GhostX ecosystem. The attackers use smishing-style messages via SMS and WhatsApp, masquerading as notices about unpaid traffic fines and directing victims to fake Google Play pages or spoofed mParivahan and eChallan portals.
The operation is linked to the GhostX infrastructure, with a publicly exposed Firebase project seen during analysis. Independent sources document 641 compromised devices and 244 stolen UPI PINs across related mParivahan Firebase databases in August 2026, while early reports linked an earlier wave to substantial fraud losses in Panchkula. Attribution is split: confirmed links tie the fake traffic-app infrastructure to GhostX, while broader MaaS-style activity remains suspected.
The malware’s infection chain includes multi-stage native unpacking designed to evade static scanners. The latest GhostBat variant hides payloads in encrypted assets and relies on a native library (libnetbridge[.]so) to unpack them. Once installed, it requests Accessibility Service permissions and overlays a transparent 12-button grid over real PIN keypads in Google Pay and MobiKwik; user taps are captured and replayed to the legitimate app, allowing PINs to be exfiltrated in parallel.
In addition to PIN capture, the trojan monitors 60 Indian banking and digital-wallet apps, collects OTPs, and can forward calls via USSD and SMS. Defence guidance emphasises keeping Play Protect enabled, denying Accessibility permissions to dubious apps, and verifying fines only on echallan.parivahan.gov[.]in; victims of fake mParivahan apps should consider device resets and PIN changes on a clean device.