Researchers at Cyble, a threat intelligence firm, have identified Android-based malicious software distributed via counterfeit traffic-penalty SMS messages that quietly captures a user's UPI PIN as it is entered into legitimate Google Pay and MobiKwik applications, while allowing the underlying transaction to complete without interruption.
Distributed via SMS messages referencing unpaid e-challans, the software — catalogued by Cyble under the name GhostBat RAT — targets mobile devices. Following those links routes users to replica web pages built to impersonate the government's Parivahan portal, or to storefronts styled after Google Play, where a version of the mParivahan app — distributed through channels outside the official marketplace — is offered for download.
Analysts at Cyble Research and Intelligence Labs (CRIL) traced the same batch of harmful applications to publicly accessible repositories on GitHub. Once the application has been granted Android's Accessibility permission by a device user, it sits dormant until a payment screen appears within Google Pay or MobiKwik.
A phantom grid of twelve touch zones is placed over the physical keypad, capturing every digit the person presses and forwarding each tap into the application simultaneously. Cyble has labelled the technique "Ghost Overlay" — a method in which the targeted user remains inside the authentic Google Pay application throughout, meaning nothing on screen raises suspicion, while the entered PIN travels to a server under attacker control.
Rupali Parate, a Senior Research Engineer at Cyble, noted that users have been trained to watch for counterfeit login screens, yet this particular malware never generates one, allowing the transaction to complete with the genuine PIN as the account holder types it in the real environment. The point of compromise, according to the findings, was the act of pressing a link inside what appeared to be a traffic-fine notification — an action that may have taken place several days beforehand.
According to researchers, when a PIN falls into the wrong hands and one-time passcodes delivered to the same device become readable by an outside party, that combination can be sufficient for an unauthorised transfer of funds to be carried out — with the Ghost Overlay method designed to target two specific applications in tandem.
Keystroke logging via that same Accessibility permission forms a separate capture pathway, one that targets keyboard entries across roughly 60 apps spanning banking, UPI, wallet, and fintech platforms — among them PhonePe, Paytm, BHIM, SBI UPI, CRED, BharatPe, Groww, and JioFinance — without any additional configuration required. Among the software's documented functions, intercepting incoming text messages — including one-time passcodes and banking notifications — sits alongside the ability to redirect calls through altered forwarding settings and to dispatch messages directly from the affected device's SIM card.
Following the trail of counterfeit applications, researchers at CRIL uncovered an unprotected Firebase database carrying the label ghostx-panel — a backend infrastructure component that Cyble has since designated as the command hub for a broader threat cluster it now monitors under the name GhostX. The repository held records spanning three user classifications — administrative accounts, ordinary end-user profiles, and automated bot identities — along with operator access logs cross-referenced against device fingerprint data, and a prepared collection of SMS phishing messages queued for delivery.
Observations made by CRIL during its monitoring of the database revealed that the campaign's message content, embedded links, vehicle registration data, and target phone numbers were all undergoing repeated alterations — a pattern that Cyble interpreted as evidence the operation remained under active management. Cyble's analysis of the divided operator responsibilities points to GhostX being made available to multiple threat actors under a malware-as-a-service arrangement.
A documentation of the GhostBat RAT threat was published by Cyble during October 2025. Over time, the people behind it have rotated through no fewer than six distinct loader configurations aimed at concealing the payload, with the most recent iteration burying it beneath stacked rounds of encryption and compression. Conventional signature-based antivirus tools find detection considerably more difficult as a result.
Work produced by CRIL's research team has been accepted for a slot on the programme at the forthcoming AVAR — Association of Anti-Virus Asia Researchers — conference.
Cyble advised Android users to download apps only from vetted official stores and to remain alert to unexpected text messages containing links, particularly those claiming to involve fines tied to traffic violations. The firm also advised anyone who notices signs of a possible infection to contact their bank promptly. Those affected by online financial fraud anywhere across India can lodge a complaint through the national helpline number 1930 or submit a report via the dedicated portal at cybercrime.gov.in.
