A new variant of GhostBat RAT can capture PINs entered within genuine Google Pay and MobiKwik applications without displaying a fake payment screen This article explores phishing infrastructures device. . The Android malware, targeting users in India via fraudulent mParivahan and eChallan applications distributed through text messages, uses a technique called Ghost Overlay to intercept keypad touches while keeping the real payment application visible.

A separate input capture feature targets 60 Android package identifiers linked to banking, UPI, wallet, fintech, and payment services. The latest investigation revealed GhostX, a comprehensive network encompassing phishing infrastructures, device management, backend services, and malware distribution. GhostBat secretly steals PINs by monitoring foreground applications and detecting if a user has accessed a targeted financial app.

Additionally, the system monitors accessibility events, collecting potentially sensitive numeric input from various targets, including applications like PhonePe, Paytm, BHIM, CRED, and others from financial services. The unpacking chain includes an RC4-like transformation, AES-256-GCM decryption, zlib decompression, and custom MSZ1 and MSP1 containers. Firebase Remote Config allows attackers to change backend addresses and toggle selected capabilities without redistributing the APK.

Other observed functions include SMS interception, call log collection, remote SMS transmission, and call forwarding manipulation. Users must ensure their Android devices and apps are kept up to date and report any suspected compromise to their bank and local authorities immediately.