At a Glance Malware Family 7 Android RAT families (cyb3rx, appkjl, godz, d-passive, d-shine, GhostBat/GhostGrab, and tenxen) paired with the d-miner XMRig dropper Threat Actor Confirmed analytical cluster tracked as CyberDakait; suspected multiple independent sub-project developers (no formal named group attributed) Target / Victims

At a Glance Malware Family 7 Android RAT families (cyb3rx, appkjl, godz, d-passive, d-shine, GhostBat/GhostGrab, and tenxen) paired with the d-miner XMRig dropper Threat Actor Confirmed analytical cluster tracked as CyberDakait; suspected multiple independent sub-project developers (no formal named group attributed) Target / Victims

Blog sobre informática, tecnología y seguridad con manuales, tutoriales y documentación sobre herramientas y programas

At a Glance Malware Family GhostBat RAT (operating within the GhostX operator ecosystem) Threat Actor Confirmed as the GhostX operator infrastructure; suspected Malware-as-a-Service (MaaS) model with unattributed individual operators Target / Victims Android users in India; 60 targeted financial and UPI apps (641 compromised devices and 244 stolen UPI PINs documented in prior related Firebase clusters) Delivery Vector

GhostBat RATの新たな亜種が、インドで使われている60のAndroid金融アプリのパッケージを標的にしていることが分かりました。この亜種は、ユーザー補助機能を悪用したPINの窃取に加え、透明なオーバーレイを重ねる手口を併用します。これにより、正規のGoogle PayやMobiKwikの画面上での操作を傍受

A new version of GhostBat Android malware is targeting users of 60 banking, UPI, wallet, fintech and payment apps in India. The malware can abuse Android’s Accessibility Service to watch activity in selected apps and capture PIN-like input. Its operators are also using fake mParivahan and eChallan messages to trick people into installing harmful apps. The latest activity shows GhostBat has grown beyond an SMS-stealing threat. The malware can collect messages and call logs, handle commands from its operators and change some of its settings after installation. That mix puts banking and payment users at risk, even when they open the real app and do not see a fake login page. Analysts from Cyble identified the new capabilities while investigating a wider operation they call GhostX. Cyble said it has tracked GhostBat activity in India since October 2025 and found links between the malware, fake government-service apps, phishing pages and an operator-controlled backend. Hackers Target 60 Indian Banking and UPI Apps The campaign begins with smishing: SMS or messaging-app messages that contain a link and pose as a traffic fine or government service notice. The link can open a fake mParivahan or eChallan page, or a page that looks like a Google Play download screen. Victims are urged to install an APK file outside the official app store. Cyble also found malicious APKs shared through public GitHub repositories and hosted files. This approach builds on earlier GhostBat activity in which fake RTO apps were used to steal banking data and read SMS messages, including one-time passwords. Readers can compare that earlier campaign with this report in Cyber Security News’ coverage of GhostBat RAT . Similar fake challan lures have also been used to spread other Android malware, as described in this report on RTO challan notification scams . GhostBat RAT Infection Chain (Source – Cyble) Once installed, GhostBat may ask for sensitive access, including Accessibility Service access. This Android feature is designed to help people use their devices, but malware can misuse it to read screen content and interact with apps. If a victim grants access, GhostBat can check which app is open and compare it with a list of financial apps selected by its operators. Cyble found a feature it calls Ghost Overlay, which targets Google Pay and MobiKwik. Rather than showing a fake payment screen, the malware places transparent touch areas over the PIN keypad in the genuine app. It records the digits a user taps, then replays the same touches so the payment app receives them and continues as normal. The victim may remain on the real screen while GhostBat captures the PIN in the background. A separate feature can capture PIN-like input across a broader set of 60 Android apps. It uses Accessibility events and screen context to identify possible PIN entry, instead of relying on the transparent keypad overlay. Fake Google Play Store-style mParivahan installation website (Source – Cyble) Cyble named apps including Google Pay, PhonePe, Paytm, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge and PayZapp among the targeted services. The report says the full target set contains 60 app package identifiers. The PIN capture adds to GhostBat’s ability to collect SMS messages, including banking alerts and OTPs, and to gather call-log and SIM details. Loaders and remote settings complicate detection The report also describes call-forwarding controls and remote SMS activity. These functions could give operators several routes to monitor a compromised phone and support financial fraud. The malware’s delivery code has changed across samples. Cyble observed at least six loader or dropper types, including encrypted APK containers, custom payload formats, in-memory DEX loading and remote APK downloads. The newest sample uses a native library called libnetbridge.so and a chain of encryption, transformation and compression stages to unpack its final payload. These layers can make it harder for basic scanners to inspect the hidden app. GhostBat also uses Firebase Remote Config to change settings without distributing a new APK. The analyzed sample used the Firebase project andromeda-d389d and a configurable base_url value. Latest native dropper unpacking chain (Source – Cyble) This lets operators change the active backend or selected features remotely, so a domain observed in one sample may not remain the only command-and-control address. For context on another Android threat that abuses Accessibility to capture banking PINs, see this report on Manic’s PIN capture methods . Install apps from trusted stores and avoid APK links delivered through unexpected texts or messages. Check an app’s publisher and purpose before granting Accessibility, SMS or notification access; a vehicle-service app should not need broad access to financial activity. Keep Android and apps updated, and contact your bank promptly if you suspect a phone or payment account has been compromised. Cyble also advises users to report suspicious activity and consider resetting credentials or the device when infection is suspected. The central risk is not only that GhostBat targets many financial apps, but that its transparent overlay can record PIN taps while the genuine payment app remains in use. Fake government-service lures, broad Accessibility access and changeable backend settings give the operators multiple ways to adapt the campaign. Indicators of compromise (IoCs):- Type Indicator Notes C2 domain hxxps://api[.]cloudsettle[.]org Default backend observed in the analyzed sample C2 endpoint /pin-data Receives captured PIN-related data Firebase project andromeda-d389d Remote configuration for the analyzed sample Firebase project ghostx-panel Linked to an earlier mParivahan sample Native library libnetbridge.so Used by the latest reported loader App asset assets/isti52q4 Stores an encrypted payload Overlay package com.mobikwik_new Listed for Ghost Overlay Overlay package com.google.android.apps.nbu.paisa Listed for Ghost Overlay Overlay package com.google.android.apps.nbu.paisa.user Listed for Ghost Overlay Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs . The post Hackers Target 60 Indian Banking and UPI Apps With New GhostBat Android Malware appeared first on Cyber Security News .

Cyble reports that GhostBat RAT targets Android users in India through mParivahan- and eChallan-themed campaigns. Its latest variant uses Accessibility…

GhostBat, een Android-malware, is geëvolueerd tot een geavanceerdere bedreiging die zich specifiek richt op gebruikers in India. De malware heeft het gemunt op gebruikers van ongeveer zestig Indiase bank-, UPI-, portemonnee-, fintech- en betaalapps. De campagne begint met smishing, waarbij kwaadwillenden nepberichten versturen die zich voordoen als verkeersboetes of overheidsberichten, met links naar potentieel schadelijke bronnen. Deze links leiden gebruikers naar nagemaakte overheidswebsites, zoals die van mParivahan en eChallan, of naar schermen die de officiële Google Play Store nabootsen. Gebruikers worden vervolgens aangemoedigd om een APK-bestand te downloaden en te installeren buite...

This weekly cybersecurity roundup covers the French freezer hack, GhostBat RAT UPI PIN theft, North Korea's job scam and Ahold Delhaize.

GhostBat RAT spreads through fake mParivahan and eChallan apps and uses a Ghost Overlay trick to capture PINs across Indian banking.

wipe h y p e SEASON 14 on Sunday Drivers!!! | Streaming project zomboid for 12 viewers.

Drone MQ-28 Ghost Bat : après le FCAS, l'Allemagne se voit proposer un drone de combat australien capable de tuer une cible presque seul

AviationNews – Boeing and Rheinmetall have joined forces in a strategic partnership to offer the MQ-28 Ghost Bat autonomous aircraft to the German Bundeswehr. The alliance aims to accelerate Germany's Collaborative Combat Aircraft (CCA) program, providing advanced "loyal wingman" capabilities for both air-to-air and air-to-ground missions by 2029. The joint initiative leverages Boeing's mature, flight-tested MQ-28 Ghost Bat platform—originally developed in Australia for the Royal Australian Air Force—to meet the German Air Force's requirement for uncrewed combat aircraft.