New GhostGrab Android Malware Silently Steals Banking Login Details and Intercept SMS for OTPs

A new Android threat named GhostGrab is reported to quietly steal banking login details and intercept SMS messages to capture one-time passwords, combining these data theft capabilities with covert cryptocurrency mining for a dual monetisation approach. According to CYFIRMA, the malware harvests banking credentials, debit card details, personal information, and OTPs, while also running a background Monero mining module once the device is under attack.

The malware uses several persistence tricks to stay active, hides its icon, avoids the app launcher, and employs foreground notifications and battery-exemption requests to resist casual detection and ensure ongoing operation. It delivers its dropper via a JS-driven redirect chain to a disguised APK, and uses an in-app installation flow to install hidden payloads, including a banking stealer module and a mining component.

Data exfiltration is enabled through a Firebase Realtime Database, with credentials and device identifiers bundled into JSON payloads, and the malware is capable of SIM reconnaissance and SMS forwarding, potentially bypassing protections and enabling continued credential access. Users are urged to uninstall suspicious apps and enable two-factor authentication via apps rather than SMS.