Hackers Target 60 Indian Banking and UPI Apps With New GhostBat Android Malware

Fake Traffic Challan Messages Used to Steal UPI PINs, Cyble Warns

AI-native threat intelligence company Cyble has found Android malware, spread through fake traffic-fine text messages, that records the UPI PIN as people type it into the genuine Google Pay and MobiKwik apps, while letting the payment go through as normal. The malware, which Cyble tracks as GhostBat RAT, reaches phones through SMS messages about unpaid e-challans. The links lead to pages impersonating the government’s Parivahan service, or to a …

Hackers Target 60 Indian Banking and UPI Apps With New GhostBat Android Malware

A new version of GhostBat Android malware is targeting users of 60 banking, UPI, wallet, fintech and payment apps in India. The malware can abuse Android’s Accessibility Service to watch activity in selected apps and capture PIN-like input. Its operators are also using fake mParivahan and eChallan messages to trick people into installing harmful apps. […]

GhostBat RAT Targets UPI PINs In 60 Indian Payment Apps

A text message about an unpaid traffic challan could cost Android users in India far more than a fine. GhostBat RAT, an Android malware strain first identified by cybersecurity firm Cyble in October 2025, has evolved to capture PINs from 60 banking, UPI apps, wallet and fintech applications, according to new research published by Cyble.