Cyble, an AI-native threat intelligence company, has found Android malware that records a person’s UPI PIN as they type it into the genuine Google Pay and MobiKwik apps. The payment still goes through as normal. The malware spreads through fake traffic-fine text messages. Cyble tracks it as GhostBat RAT.
How It Reaches Phones
Victims get an SMS about an unpaid e-challan. The links lead to pages that pose as the government’s Parivahan service, or to a download page styled like Google Play. These push victims to install a fake mParivahan app from outside the Play Store. Researchers at Cyble Research and Intelligence Labs (CRIL) also found the malicious apps on public GitHub repositories.
The Ghost Overlay Trick
Once a victim gives the fake app Android’s Accessibility permission, it waits for Google Pay or MobiKwik to open a PIN screen. It then lays a transparent grid of 12 touch zones over the real keypad. It logs each digit the user taps and replays the same tap into the app. Cyble calls this technique Ghost Overlay.
Nothing on screen looks wrong, because the user never leaves the real app. The PIN goes to a server run by the attackers.
Rupali Parate, Senior Research Engineer at Cyble, said people have learned to look for fake login pages and this malware never shows one. The victim types a real PIN into the real app and the payment works. The only mistake was tapping a link in a challan message, possibly days earlier. Once attackers hold the PIN and can read the OTPs arriving on the same phone, they have most of what they need to move money out of the account.
Wider Reach
Ghost Overlay targets two apps. A second method reads keypad input through the same Accessibility access. By default it covers 60 banking, UPI, wallet and fintech apps. These include PhonePe, Paytm, BHIM, SBI UPI, CRED, BharatPe, Groww and JioFinance.
The malware also reads incoming SMS, including OTPs and bank alerts. It can change call-forwarding settings and send text messages from the victim’s SIM.
An Exposed Control Panel
Tracing the fake apps led CRIL to an exposed Firebase database named ghostx-panel. It is the control backend for a wider operation that Cyble tracks as GhostX. The database held separate admin, user and bot-user accounts. It also held operator login records with device fingerprints and SMS lures queued for sending.
While CRIL watched, the message text, phishing links, vehicle registration numbers and recipient phone numbers kept changing. Cyble said this shows the campaign is run actively. The split between operator roles suggests GhostX could be rented to several groups as malware-as-a-service.
A Changing Threat
Cyble first reported GhostBat RAT in October 2025. Since then, its authors have used at least six loader designs to hide the payload. The newest wraps it in several layers of encryption and compression. That makes it harder for signature-based antivirus tools to spot.
CRIL’s analysis has been selected for presentation at the upcoming Association of Anti-Virus Asia Researchers (AVAR) conference.
How to Stay Safe
Cyble advises Android users to install apps only from official stores. They should ignore download links sent by SMS, including messages about traffic fines. Anyone who suspects an infection should alert their bank at once. In India, cyber fraud can be reported on the national helpline 1930 or at cybercrime.gov.in.
