GhostBat RAT Targets Indian Android Users via Fake Traffic Challan SMS
An evolved Android remote access trojan now steals UPI PINs through fraudulent traffic fine notifications and disguised app downloads.
Key points
- GhostBat RAT captures credentials from sixty banking and fintech applications on Android devices.
- Attackers distribute the malware via SMS phishing messages impersonating official traffic challan services.
- The campaign uses first-stage loaders to hide the malicious payload from initial security scans.
GhostBat remote access trojan is stealing Unified Payments Interface PINs from Android users in India by impersonating traffic fine notifications. According to research published by cybersecurity firm Cyble, this malware strain has evolved to capture sensitive credentials from sixty banking, digital wallet and financial technology applications. The campaign targets victims through deceptive text messages that appear to be official unpaid traffic challans.
How it unfolded
- Cyble first identified the GhostBat RAT strain in October 2025.
- The firm subsequently published new research detailing the malware’s evolution to target UPI PINs.
- Investigators uncovered a wider operator-controlled ecosystem tracked as GhostX, linking phishing pages and backend systems.
Who is affected
Android users in India are the primary targets of this campaign. Victims receive SMS messages containing malicious links that direct them to pages impersonating the official Parivahan service or Google Play download interfaces. These pages persuade users to install fraudulent mParivahan or eChallan APK files. According to The Cyber Express, the malware spreads mainly through this smishing technique, exploiting trust in government traffic services.
The fix
Cyble’s investigation exposed the broader infrastructure supporting the GhostBat distribution. The researchers linked the malware to a network of phishing pages and backend control systems they track as GhostX. This ecosystem includes GitHub repositories that operators repeatedly use to host the malicious files. No patch or update has been confirmed yet by the vendors of the targeted banking or fintech applications.
What analysts watch for
Teams usually examine SMS logs for links impersonating government services or payment portals. Analysts check whether devices have installed APKs from unknown sources rather than official app stores. They inspect network traffic for connections to newly registered domains or suspicious backend control systems. Security teams also review installed applications for first-stage loaders that download additional payloads later. Checking for encrypted files within seemingly harmless apps helps reveal hidden malicious components.
What to do and how to stay safe: GhostBat RAT
- Verify the source of any text message claiming unpaid fines before clicking links.
- Install applications only from official app stores rather than browser download pages.
- Monitor device permissions for apps requesting access to banking or financial data.
- Wait for vendor updates if a device is suspected of hosting this malware.
Step-by-step guide: Ransomware Incident Response: Steps to Contain and Recover
General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What does GhostBat RAT steal from victims?
It captures PINs and credentials from sixty banking, UPI, wallet and fintech applications on Android.
How is the malware distributed to users?
It spreads via SMS phishing messages that link to fake traffic challan pages or Google Play imitations.
Who discovered this threat?
Cybersecurity firm Cyble identified the strain and published research on its evolution and infrastructure.
