Android SMS Phishing: GhostBat RAT Steals Fintech PINs via Fake mParivahan Pages in India
Android users in India face increased risk as the GhostBat malware evolves to steal financial credentials through deceptive text messages impersonating traffic services.
Key points
- GhostBat RAT captures PINs from sixty banking, UPI, and fintech applications.
- The malware spreads via SMS phishing links to fake mParivahan download pages.
- Researchers link the campaign to a broader GhostX ecosystem of control servers.
The GhostBat remote access trojan has expanded its capabilities to target financial credentials on Android devices in India. According to research published by cybersecurity firm Cyble, this malware strain, first identified in October 2025, now captures PINs from sixty banking, UPI, and fintech applications. The attack relies on social engineering rather than a software vulnerability in the operating system.
Root cause
The core issue stems from user interaction with malicious links disguised as urgent official communications. The malware distributors exploit the trust users place in government traffic enforcement services. By sending text messages about unpaid challans, attackers trick victims into visiting fraudulent websites. These sites impersonate the official Parivahan service or mimic Google Play Store interfaces.
Attack path
Victims receive SMS messages containing links to fake traffic challan notices. Clicking these links directs users to pages that push the installation of a fraudulent mParivahan APK. Many of these initial apps act as loaders. The actual malicious payload remains hidden in encrypted files or is downloaded later, allowing the app to appear harmless during initial security scans. Researchers noted that GitHub repositories are frequently used to host these malicious files.
Affected versions
- Android devices running any version susceptible to side-loaded APK installation
- Environments where users install apps outside of official app stores
- Devices connecting to networks that allow access to malicious hosting platforms
Mitigation
- Disable installation of apps from unknown sources in device settings
- Verify traffic challan status only through official government websites or apps
- Avoid clicking links in unsolicited SMS messages regarding fines or penalties
- Use mobile security software that scans for suspicious behavior patterns
Detection notes
Security teams should monitor for unusual outbound network connections from mobile devices, especially to newly registered domains. Look for installations of apps that request excessive permissions beyond their stated function. Check logs for repeated failed authentication attempts to financial services. Investigate any device that has installed APKs from non-standard repositories. Isolate affected devices immediately to prevent lateral movement or data exfiltration. Review SMS logs for messages containing unexpected links or urgent payment requests.
Background: Phishing
Phishing tricks you into taking action by disguising malicious intent as legitimate communication. You stop it by verifying sources, using passkeys, and treating every unsolicited request as suspicious until proven otherwise. Technical controls like email authentication and network segmentation reduce risk but cannot eliminate human error.
Read the full guide: Phishing Defenses: Answers to 10 Critical Questions
What to do and how to stay safe: GhostBat RAT
- Check your Android settings to ensure installation from unknown sources is disabled
- Verify any traffic fine notifications by visiting the official Parivahan website directly
- Monitor your banking and UPI apps for unauthorized transactions or login attempts
- Install reputable mobile security software to scan for hidden or encrypted malicious payloads
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is GhostBat RAT?
GhostBat RAT is an Android malware strain that captures PINs from banking, UPI, and fintech applications.
How does GhostBat RAT spread?
It spreads through SMS phishing messages containing links to fake traffic challan pages.
Who is behind the GhostBat campaign?
Researchers link the campaign to a broader ecosystem tracked as GhostX, involving phishing pages and control systems.
