A text message about an unpaid traffic challan could cost Android users in India far more than a fine. GhostBat RAT, an Android malware strain first identified by cybersecurity firm Cyble in October 2025, has evolved to capture PINs from 60 banking, UPI apps, wallet and fintech applications, according to new research published by Cyble. The firm's investigation into fake mParivahan and eChallan apps also exposed a wider operator-controlled ecosystem it tracks as GhostX, linking phishing pages, backend control systems and malware distribution.

How GhostBat RAT Reaches Victims

The malware spreads mainly through smishing, or SMS phishing. Victims receive messages with malicious links that lead to pages impersonating the official Parivahan service or a Google Play-style download page. These pages push users to install a fraudulent mParivahan APK. Researchers also found GitHub repositories being repeatedly used to host the malicious files. Many of these apps are only first-stage loaders. The real payload stays hidden in encrypted files or is downloaded later, which makes the app look harmless during an initial scan. [caption id="attachment_114830" align="aligncenter" width="600"] GhostBat-RAT-Infection-Chain-1536x595[/caption]

GhostBat RAT's Ghost Overlay Trick

The most significant change in the latest variant is its abuse of Android's Accessibility Service, a technique commonly linked to modern Android banking trojan families. Earlier variants analyzed by Cyble did not have this capability. Its standout feature, called Ghost Overlay, targets Google Pay and MobiKwik. Instead of showing a fake login screen, the malware places an invisible 12-key grid over the real PIN keypad. When a user taps a digit, the overlay records it and then replays the same tap into the genuine app. The payment goes through normally, so the victim has no visible reason to suspect anything, while the PIN is quietly sent to the attackers' server.

GhostBat RAT Watches 60 Financial Apps

Beyond Google Pay and MobiKwik, a broader keylogging feature monitors 60 financial apps. Cyble's list includes PhonePe, Paytm, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge, PayZapp, Groww, Navi, Jupiter, OneCard, JioFinance and Samsung Pay. The malware checks which app is open and the screen context before treating numeric input as a possible PIN. This builds on older capabilities that remain in play, including reading SMS messages and OTPs, manipulating call forwarding, collecting call logs and sending SMS messages through the victim's SIM card, which could be used to spread further smishing campaigns.

Inside the GhostX Network Behind GhostBat RAT

A key finding came from an exposed Firebase backend named "ghostx-panel." It contained administrator records, user roles, login logs with device fingerprints and bot-user mappings. Cyble says these separate roles point to a multi-operator setup and raise the possibility of a Malware-as-a-Service model. While monitoring the backend, researchers saw SMS lure text, phishing links, vehicle registration numbers and recipient phone numbers changing repeatedly, indicating an active campaign. Matching eChallan messages were also reported by users on social media.

Why GhostBat RAT Is Hard to Detect

Cyble identified at least six different loader designs. The newest, built around a native library called libnetbridge.so, passes the payload through several layers of encryption, compression and custom packaging before the final app appears. Security tools that scan only the outer APK are unlikely to catch it consistently. The malware also uses Firebase Remote Config, which lets operators switch command servers and turn features on or off remotely without pushing a new app to victims.

Staying Safe From GhostBat RAT

Cyble advises users to install apps only from official stores such as Google Play and to avoid APK links received by SMS, social media or email. Users should be cautious about granting app permissions, especially Accessibility access, verify website addresses before entering sensitive details, enable multi-factor authentication on financial apps and keep their phones updated. Anyone who suspects infection should contact their bank and local authorities immediately.

A text alert about an undelivered package or an unpaid toll may look like a one-off scam. A new Microsoft cybercrime crackdown shows it is often the visible end of a much larger operation. Microsoft and Health-ISAC, a global non-profit that helps health sector organizations share cyber threat information and improve operational resilience, have moved to dismantle three services, YAM Store, CoGUI and Iron Man, that supplied criminals worldwide with accounts, hosting and tools to build fake websites and online identities. Since January 2026, the three services have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide. More than 750 million of those messages were aimed at Microsoft customers alone. Consumers, healthcare organizations, financial institutions and other businesses in more than 150 countries were targeted, generating tens of millions of dollars for the operators.

How the Microsoft Cybercrime Crackdown Began

The investigation started in late 2025 after Japan's National Police Agency (NPA) alerted Microsoft to malicious messaging campaigns targeting people in Japan. The NPA continued providing intelligence and investigative support throughout the probe as partners traced those campaigns back to the businesses supplying criminals around the world. Investigators expected to find individual campaigns. Instead, they traced the activity to a sprawling Chinese-language marketplace that was difficult for non-native-speaking investigators to penetrate. The probe widened to include the Japan Cybercrime Control Center (JC3), Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs. Drawing on its network of more than 130 member organizations, JC3 linked what appeared to be separate incidents into a broader pattern of scams against Japanese companies and financial institutions. Health-ISAC provided insight into the impact on healthcare organizations.

What the Microsoft Cybercrime Crackdown Uncovered

YAM Store operated much like an online shop. Customers could browse products, compare prices and buy fraudulent Microsoft and Google accounts along with ready-made scam tools, including those used for credential theft. Controlled purchases by Microsoft helped confirm how it worked. In some cases, operators bought internet domains that legitimate organizations had allowed to expire, often in sectors such as non-profits and education, with specialized product offerings for those sectors. They rebuilt the websites to make those organizations appear active, then used them to fraudulently obtain Microsoft 365 accounts for resale. The infrastructure sold through YAM Store was frequently paired with CoGUI. This service supplied ready-made websites and messages impersonating companies, banks, government agencies and other trusted organizations. Rather than build fraudulent sites themselves, criminals could quickly deploy pages designed to steal passwords, payment details and personal data. CoGUI became one of the most widely used offerings in the ecosystem, particularly targeting victims in Japan and the United States. [caption id="attachment_114817" align="aligncenter" width="600"] Image Source: https://blogs.microsoft.com/[/caption] By mid-2026, CoGUI was increasingly being replaced by Iron Man, which offered thousands of phishing templates tailored to specific brands, industries and countries. Criminals could use them to quickly deploy email, text and web content. Through test purchases and work with Resecurity, investigators identified more than 2,300 templates impersonating banks, retailers, healthcare providers, transportation authorities, police departments and government agencies across more than 150 countries. Others mimicked airlines, telecommunications companies and parcel delivery services. Some were built for government impersonation scams, using the look of official authority to pressure victims into paying or sharing sensitive information. Microsoft noted that an organization appearing in these templates does not mean its systems were compromised.

Court Order Backs Microsoft Cybercrime Crackdown

Acting on an order from the United States District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains that formed part of the infrastructure behind the three services. Microsoft has disabled more than 20,000 accounts linked to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud, while removing infrastructure hosted on its services. Microsoft also shared intelligence with the U.S. Secret Service and international law enforcement partners. Investigators used AI tools to connect accounts, websites and infrastructure that initially appeared unrelated. The case reflects a trend highlighted in this year's Microsoft Digital Defense Report: modern fraud increasingly relies on businesses and services that help criminals reach more victims. No single organization saw the full picture of this transnational cybercrime network, and uncovering it required two-way information sharing across industries and borders. YAM Store, CoGUI and Iron Man are only part of a larger criminal ecosystem. Still, the Microsoft cybercrime crackdown makes it harder for criminals to obtain the accounts, tools and infrastructure that keep scam messages flowing. Microsoft Threat Intelligence has published a blog with further details on the network and steps customers can take to protect themselves.