A newly enhanced version of the GhostBat Android malware is now targeting users across 60 banking and financial applications in India. This malicious software exploits Android’s Accessibility Service to monitor activities within these apps and capture sensitive inputs such as PINs.
Deceptive Tactics and Expanding Capabilities
Operators behind GhostBat are employing fake notifications from mParivahan and eChallan to deceive users into downloading harmful applications. The malware has evolved from merely stealing SMS messages to a more sophisticated threat, capable of collecting messages and call logs, executing commands, and modifying its settings post-installation.
This combination of capabilities poses a significant threat to banking and payment app users, even if they access legitimate applications without encountering fake login interfaces. Researchers at Cyble uncovered these advanced features while investigating an operation they have termed GhostX.
Smishing Campaigns and Infection Techniques
The malware campaign initiates with smishing tactics, where messages posing as traffic fines or government service notices are sent. These messages include links leading to fake mParivahan or eChallan pages, or even imitation Google Play Store download screens. Victims are enticed to install APK files outside official app channels. Cyble has identified malicious APKs distributed via public GitHub repositories and hosted files.
The methodology leverages previous GhostBat activities, where fraudulent RTO applications were used to steal banking data and intercept SMS messages, including one-time passwords. Similar lures have been utilized to disseminate other Android malware, reflecting a recurring pattern in cyber threats.
Advanced Features and Security Implications
Upon installation, GhostBat requests sensitive permissions, including access to Accessibility Services, enabling it to read screen content and interact with apps fraudulently. If granted, the malware can track the open apps and target financial applications specifically chosen by the operators.
Cyble highlighted a feature called Ghost Overlay, which targets apps like Google Pay and MobiKwik. This function overlays transparent touch areas over the genuine app’s keypad, recording inputs while the user remains unaware. This feature allows the malware to capture PINs amidst legitimate app use.
The malware extends its reach by capturing PIN-like inputs across a broader range of 60 Android apps, using Accessibility events and screen context to detect potential PIN entries. Such capabilities, alongside its ability to gather SMS messages, call logs, and SIM information, significantly increase the threat level.
Implications and Defensive Measures
The GhostBat malware’s evolving nature, with its transparent overlay and extensive app targeting, underscores the importance of robust security practices. Users are advised to install applications solely from trusted stores and avoid APK links from unexpected messages. Verifying an app’s publisher and purpose before granting permissions is crucial to maintaining device security.
Keeping Android systems and applications updated is essential, alongside promptly contacting banks if any compromise is suspected. Cyble advises users to report any suspicious activity and consider resetting credentials or devices if an infection is suspected.
The overarching risk lies not only in the sheer number of targeted financial apps but also in GhostBat’s capacity to record sensitive information while the genuine payment app remains active. The use of fake government-service lures, extensive Accessibility access, and adaptable backend settings provide operators with multiple avenues to sustain and expand the campaign.
