Check Android Accessibility Settings to Block GhostBat Banking Malware
GhostBat malware targets 60 Indian financial apps by abusing accessibility services to capture PINs and screen activity.
Key points
- GhostBat targets 60 banking and UPI apps in India using fake traffic fine messages.
- The malware abuses Android Accessibility Service to capture PIN inputs via transparent overlays.
- Operators use fake mParivahan and eChallan pages to distribute malicious APK files.
Users of banking, UPI, and fintech applications in India face a new threat from GhostBat Android malware. According to Cyber Security News, this campaign targets 60 specific financial apps. The malware captures sensitive data by abusing the Android Accessibility Service. It allows operators to watch screen activity and record PIN-like inputs. This puts account holders at risk even when they use legitimate apps.
Root cause
The vulnerability stems from how Android’s Accessibility Service is designed and used. This feature helps users with disabilities navigate devices. Malware operators misuse it to read screen content and interact with applications. Once installed, GhostBat requests this sensitive access. If granted, it can monitor which app is open. It then compares the active app against a list of targeted financial services.
Attack path
The campaign begins with smishing messages posing as traffic fines or government notices. Links lead to fake mParivahan or eChallan pages, or fake Google Play screens. Victims are urged to install APK files outside the official app store. Some malicious files are also shared via public GitHub repositories. Once installed, the malware collects messages and call logs. It handles commands from operators and changes settings.
Affected versions
- Users of 60 specific banking apps in India
- Users of UPI payment applications
- Users of digital wallet services
- Users of fintech and payment platforms
- Any Android device where Accessibility Service is granted to unknown apps
Mitigation
- Avoid installing APK files from outside the official Google Play Store.
- Do not click links in SMS messages claiming to be traffic fines.
- Review Accessibility Service permissions in Android settings regularly.
- Remove any apps that request unnecessary screen-reading capabilities.
For customers and users
If you use banking or payment apps on Android, check your accessibility settings immediately. Look for apps you do not recognize that have screen-reading permissions. Disable them if found. Be wary of SMS messages about traffic fines or government services. These are common lures for malware. If you receive such a message, verify it through the official government website or app. Do not click links in unsolicited texts. Monitor your bank statements for unauthorized transactions.
Background: Android malware
Android is not inherently secure against malware. The operating system relies on user permission choices. Granting unnecessary access allows malicious apps to operate within system boundaries. Sideloading apps bypasses store security checks. Understanding permission scopes and source verification protects your device from common threats.
Read the full guide: Android Malware Myths: Why Your Phone Is Not Actually Safe
What to do and how to stay safe: GhostBat
- Check your Android accessibility settings for unknown apps with screen-reading permissions.
- Verify any traffic fine or government service message through official channels, not SMS links.
- Ensure you only install apps from the official Google Play Store.
- Monitor your financial accounts for any suspicious transactions or unauthorized access.
Step-by-step guide: Offline Backup Mistakes That Break Ransomware Recovery
General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What apps does GhostBat target?
It targets 60 banking, UPI, wallet, fintech, and payment apps in India.
How does GhostBat capture PINs?
It abuses the Accessibility Service to place transparent overlays over PIN keypads in genuine apps.
How is the malware distributed?
Through fake mParivahan and eChallan messages that link to malicious APK files.
