Block GhostBat Android Malware Spreading via Fake Traffic Fine Messages
Attackers use fake government notifications to install malware that abuses accessibility services to steal financial data from Indian banking apps.
Key points
- GhostBat targets 60 Indian banking and payment applications using a new overlay technique.
- Attackers distribute the malware through SMS messages posing as traffic fines or government notices.
- The malware abuses Android Accessibility Services to capture PIN inputs without fake login screens.
A new variant of the GhostBat Android malware is actively targeting users of sixty banking, UPI, wallet, and fintech applications in India. According to Cyber Security News, the threat actors are using deceptive messages that mimic traffic fines or government service notices to trick victims into installing harmful software. This campaign represents a shift from previous SMS-stealing tactics to more sophisticated credential harvesting methods.
The risk
The malware abuses Android’s Accessibility Service feature, which is designed to assist users with disabilities but can be misused to read screen content. Once installed, GhostBat monitors which applications are open and compares them against a list of financial apps selected by its operators. This allows the malware to watch activity within legitimate applications rather than forcing users to enter credentials on fake pages.
Who is exposed
Users in India who interact with banking or payment apps are at risk, particularly those who click links in SMS or messaging app notifications. The attackers use fake mParivahan and eChallan pages to lure victims into downloading APK files outside of official app stores. Cyber Security News reports that malicious files are also shared through public GitHub repositories and hosted file links.
Cost and compliance
Analysts from Cyble identified these new capabilities while investigating a wider operation they call GhostX. Cyble stated it has tracked GhostBat activity in India since October 2025 and found links between the malware, fake government-service apps, phishing pages, and an operator-controlled backend. The report does not specify financial losses or regulatory penalties incurred by victims or organizations.
Our take on the response
Security teams should treat any APK installation request triggered by SMS links as highly suspicious, especially if the message references government services. Organizations with mobile device management policies must enforce strict app installation controls to prevent sideloading. Monitoring for abnormal Accessibility Service requests is critical for early detection of this specific threat vector.
What defenders should look for
Teams usually detect this activity by monitoring for unusual requests to enable Accessibility Services, particularly from recently installed applications. Check whether legitimate financial apps are being accessed simultaneously with unknown processes running in the background. Look for transparent overlays or unexpected touch interactions on PIN entry screens. Containment moves typically involve revoking accessibility permissions immediately and removing the suspect application to stop data exfiltration.
Background: Threat actors
Small businesses must treat threat actors as automated scripts rather than targeted spies. Focus on patching, least privilege, and monitoring. Ask your IT provider about specific detection rules and incident response plans to reduce mean time to detect and limit damage during an intrusion.
Read the full guide: Threat Actors: Practical Defense Strategies for Small Businesses
What to do and how to stay safe: GhostBat
- Verify the source of any SMS claiming to be a traffic fine or government notice before clicking links.
- Avoid installing APK files from outside official app stores, even if the message appears urgent.
- Review which applications have Accessibility Service permissions and revoke access for any unknown apps.
- Monitor device behavior for transparent overlays or unusual screen interactions when entering PINs.
Step-by-step guide: Ransomware Myths Debunked: The Hidden Truths About Encryption Attacks
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How does GhostBat steal data from banking apps?
It abuses the Android Accessibility Service to monitor screen activity and capture PIN-like inputs from legitimate applications.
What lures are attackers using to spread the malware?
Attackers use fake mParivahan and eChallan messages that pose as traffic fines or government service notices.
Which apps are targeted by this campaign?
The malware targets sixty banking, UPI, wallet, fintech, and payment applications in India.
