How GhostBat Android Malware Captures PINs via Accessibility Service Abuse

A new version of the GhostBat Android malware is actively targeting users of sixty banking, UPI, wallet, fintech and payment applications in India. According to Cyber Security News, the malicious code abuses the Android Accessibility Service to monitor user activity within selected apps and capture PIN-like input. This capability allows operators to steal credentials even when victims interact with genuine applications rather than fake login pages.

By the numbers

• Sixty banking, UPI, wallet, fintech and payment apps are currently targeted by this specific malware variant in India.
• Cyble has tracked GhostBat activity in the region since October 2025, linking it to a wider operation named GhostX.
• The campaign utilizes fake mParivahan and eChallan messages as primary vectors for distributing harmful application packages.

What the figures mean

The scope of sixty targeted applications indicates a broad strategy to capture financial credentials across multiple platforms rather than focusing on a single bank. According to Cyber Security News, this represents an evolution for GhostBat beyond its earlier role as an SMS-stealing threat. The inclusion of UPI and wallet apps suggests operators aim to intercept real-time transactions and one-time passwords. By targeting a wide range of financial tools, the malware increases its chances of capturing valuable data from any given victim.

What to watch

Analysts from Cyble identified these new capabilities while investigating a wider operation they call GhostX. They found links between the malware, fake government-service apps, phishing pages and an operator-controlled backend. The malware can collect messages and call logs, handle commands from its operators and change some of its settings after installation. This mix puts banking and payment users at risk, even when they open the real app and do not see a fake login page.

Infection and persistence in general

Teams usually examine how malware arrives via deceptive links in SMS or messaging apps that mimic official government notices. Once installed, the code often requests Accessibility Service permissions, which allow it to read screen content and interact with applications. Analysts check whether the malware overlays transparent touch zones on legitimate apps to capture input without displaying fake screens. Persistence is maintained through background commands and settings changes, allowing operators to collect logs and messages over time.

What to do and how to stay safe: GhostBat

• Review installed applications for any unknown apps, particularly those related to government services or traffic fines, and remove them immediately.
• Check Accessibility Service settings to ensure no unauthorized apps have been granted permission to control or monitor device activity.
• Verify the source of any SMS or message claiming to be a traffic fine or government notice before clicking links or downloading files.
• Monitor bank and payment app activity for unauthorized transactions, as the malware can capture PINs and one-time passwords from legitimate screens.

Step-by-step guide: Ransomware Incident Response: A Step-by-Step Operational Playbook

General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How does GhostBat steal PINs without using a fake login page?

It uses a feature called Ghost Overlay to place transparent touch areas over the PIN keypad in genuine apps like Google Pay and MobiKwik.

What kind of messages are used to distribute this malware?

Operators use fake mParivahan and eChallan messages that pose as traffic fines or government service notices to trick users into installing harmful apps.

Has this malware been active in India for a long time?

Cyble has tracked GhostBat activity in India since October 2025, noting that it has grown beyond an SMS-stealing threat to target financial apps.