GhostBat Is Back: Fake Traffic Fine Texts Steal UPI PINs

GhostBat Is Back: Fake Traffic Fine Texts Steal UPI PINs Key takeaways

• GhostBat RAT has resurfaced, according to Cyble, using an invisible "Ghost Overlay" on the PIN keypad to capture UPI and banking PINs across 60 Indian banking, UPI and wallet apps.
• It starts with a fake traffic-fine or e-challan text that links to a page imitating a government service and pushes you to install an APK outside the Play Store.
• Once installed it can read SMS and OTPs, log calls, manipulate call forwarding and change behaviour remotely through Firebase.
• Never install an APK from a link in a message, and be deliberate about Accessibility permission. Arjuna's SMS Scam Detection, Fake APK Detection and Sideloaded App Detection each cover one step of the chain; none is a guarantee.** A traffic-fine text that isn't about a traffic fine at all** Cybersecurity research firm Cyble, the same group that first identified GhostBat RAT back in October 2025, published new findings in October 2026 showing the Android malware has resurfaced — and it's more dangerous than before. The attack starts in a place almost every Indian smartphone user has seen before: a text or messaging-app notification claiming you have an unpaid traffic fine, with a link to "check" or "pay" it through mParivahan or eChallan, the real government platforms drivers already use. The link doesn't lead to a government site. It opens a page built to look like one — sometimes even styled to resemble a Google Play download screen — and from there it pushes you to install an APK file directly, bypassing the Play Store entirely. Researchers also found copies of the same malicious file sitting on public GitHub repositories and ordinary file-hosting services, which is part of what's letting this campaign keep resurfacing even after earlier takedowns. Once installed, GhostBat doesn't ask for much that looks alarming on the surface — just Android's Accessibility Service permission, the same one many legitimate apps request for screen readers and automation. But in GhostBat's hands, that permission powers something researchers are calling the "Ghost Overlay" technique: an invisible 12-key grid is placed directly on top of your real banking or UPI app's PIN keypad. When you type your PIN as normal, the overlay silently records every digit you press while simultaneously replaying those same taps into the genuine app underneath. Your payment goes through exactly as expected. Nothing on screen looks wrong. Meanwhile, your PIN has already been sent to the attacker's server in the background. The malware doesn't stop there. It also reads incoming SMS messages — including one-time passwords — logs your calls, can quietly manipulate call forwarding settings, and pulls remote configuration updates through Firebase, meaning attackers can change how it behaves without ever pushing a new app update. Named targets across the campaign include Google Pay, PhonePe, Paytm, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge, PayZapp, MobiKwik, and Samsung Pay — 60 banking, UPI, wallet, and fintech apps in total, according to Cyble's count.** Why this one deserves more attention than the usual scam-alert headline** Fake traffic-fine messages aren't new — variations of this exact lure (fake e-challan, fake RTO notices) have shown up repeatedly in Indian fraud reporting over the past year, including a case just one day before this research surfaced: a 70-year-old vegetable transporter near Pune who lost ₹24.35 lakh and broke a ₹70 lakh fixed deposit after installing an APK called "RTO Challan" from a WhatsApp group. What makes GhostBat's resurgence worth a closer look is the scale and the sophistication of what happens after the install. Most people's mental model of "falling for a scam" involves some visible sign something is wrong — a frozen screen, a weird redirect, a payment that doesn't go through. Ghost Overlay is specifically designed to remove every one of those signs. The payment completes. The app behaves normally. The only thing that's different is which server quietly received your PIN along with it. And because the malware also intercepts OTPs and can manipulate call forwarding, even the second layer of protection banks rely on — a confirmation code sent to your phone — can be compromised on the same device, by the same install. The other reason this matters beyond a single incident: this isn't one victim's story, it's an active, ongoing campaign with a specific, repeatable delivery method — a text message with a link, pointing at a fake government-service page, pushing a sideloaded APK. That's a mechanism you can actually train yourself to recognize, which is different from a one-off story you just feel bad about.** What to actually do about it**

1. Never install an APK file that arrives through a link in a text message or chat, no matter who it claims to be from. Government services — mParivahan, eChallan, income tax portals, anything official — don't distribute their apps this way. If you want to check a traffic fine, open the official app you already have installed, or go to the government website directly by typing the address yourself, not by tapping a link someone sent you.
2. Treat any page that asks you to install something before you can "continue" as a red flag, especially one you reached by tapping a link rather than searching for it yourself. A page styled to look like a Play Store listing is not the Play Store.
3. Be deliberate about Accessibility Service permissions. Very few apps legitimately need it. If an app you just installed from outside the Play Store asks for Accessibility access and you're not sure why, that's a moment to stop and uninstall, not a box to tap through.
4. If you've already installed something you're now unsure about, don't just delete the app — check your bank and UPI activity directly through your bank's app or branch, and consider the device compromised until you've run a proper scan or done a factory reset, since GhostBat's remote-configuration ability means its behavior can change after install. This is exactly the kind of attack chain that two of Arjuna's confirmed features are built around, each covering one link in the chain rather than the attack as a whole. SMS Scam Detection scans the text of incoming messages for malicious links and known-bad URLs before you tap them — the fake e-challan link in step one of this campaign is precisely the kind of artifact that scan is designed to catch. Separately, Sideloaded App Detection and Fake APK Detection (both part of Arjuna's Device Protection, included in the Premium plan) flag apps installed outside the Play Store at install time — which is exactly how GhostBat gets onto a phone in the first place, since it's never distributed through Google Play. Neither feature is a guarantee against every version of this malware ever written, but both are aimed squarely at the two moments in this specific attack where a user still has a chance to stop it: before the link is tapped, and before the APK is allowed to run. The broader habit worth building, with or without any app's help, is the one these researchers kept coming back to: a message that creates urgency around a fine, a fee, or a legal notice, and then asks you to tap a link and install something — is a pattern, not a coincidence, and it's worth treating every single instance of it with the same suspicion.** GhostBat malware: frequently asked questions What is GhostBat malware?** GhostBat is an Android remote-access trojan first identified by Cyble in October 2025 that has resurfaced. It uses Accessibility Service permission and an invisible overlay on the PIN keypad to record UPI and banking PINs.** How does the fake traffic-fine text lead to GhostBat?** A text or message claims you have an unpaid traffic fine and links to a page imitating mParivahan or eChallan, which pushes you to install an APK directly, bypassing the Play Store.** What is the Ghost Overlay technique?** An invisible 12-key grid is placed over the real PIN keypad. It records every digit you press and replays the taps into the genuine app, so the payment goes through while your PIN is sent to the attacker.** What should I do if I installed a suspicious traffic-fine app?** Don't just delete it: check your bank and UPI activity through your bank's app or branch, treat the device as compromised until it is scanned or reset, and report to 1930.** Can Arjuna protect against GhostBat?** Arjuna's SMS Scam Detection scans message text for malicious links and known-bad URLs, and Fake APK Detection and Sideloaded App Detection (Premium) flag apps installed from outside the Play Store. They address two moments in the attack and are not a guarantee against every version.** Where to report and get help** If you lose money or suspect fraud, call the national cybercrime helpline 1930 or report at cybercrime.gov.in. Tell your bank straight away.** Protect your phone** Stop. Check. Stay Safe. Download Arjuna for Android and iOS. Share this guide with a parent, relative or colleague who uses WhatsApp or UPI. Related on Arjuna: Fake e-Challan APK scams · Scam protection · Android protection · Phishing links · SafePay · More cyber alerts