New GhostBat Android Malware Targets 60 Banking and UPI Apps to Steal PINs

What happened

A new GhostBat RAT variant targets 60 Android financial application packages used in India, combining accessibility-based PIN capture with a transparent overlay that intercepts interactions inside legitimate Google Pay and MobiKwik interfaces. Read New GhostBat Android Malware Targets 60 Banking and UPI Apps to Steal PINs By Mayura Kathir October 17, 2026 Share Facebook Twitter Pinterest WhatsApp A new GhostBat RAT variant targets 60 Android financial application packages used in India, combining accessibility-based PIN capture with a transparent overlay that intercepts interactions inside legitimate Google Pay and MobiKwik interfaces. Google is an Internet and software company based in Mountain View.

The latest variant moves beyond those phishing interfaces to capture input while victims use genuine financial applications. Once enabled, the malware monitors foreground applications and identifies targeted PIN-entry contexts.

The findings extend Cyble’s October 2025 investigation, which documented GhostBat spreading through fraudulent mParivahan applications, harvesting banking messages, and stealing UPI PINs through […] The post New GhostBat Android Malware Targets 60 Banking and UPI Apps to Steal PINs appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform . Android cyber security Cyber Security News 2 min.

The findings extend Cyble’s October 2025 investigation, which documented GhostBat spreading through fraudulent mParivahan applications, harvesting banking messages, and stealing UPI PINs through counterfeit payment screens. GhostBat’s most distinctive addition, Ghost Overlay, requires victims to grant Android Accessibility Service access.