GhostBat RAT: How RTO-Themed Android Malware Steals Your UPI PIN

"GhostBat" is the name Cyble's research team gave to a resurgent family of RTO-themed Android malware hitting Indian users through 2025. It impersonates mParivahan, the government's vehicle-services app, and it is a clean example of how modern Indian banking malware works: no exploit, a believable lure, and a surprisingly layered delivery chain designed to get past both the user and the analyst.

Cyble observed more than 40 distinct samples of this family. This is a breakdown of how one works, from the WhatsApp message to the stolen UPI PIN.

At a glance

• Family: GhostBat RAT (Cyble naming)
• Masquerades as: mParivahan / RTO challan app
• Delivery: WhatsApp and SMS smishing with shortened URLs → APKs hosted on GitHub
• Core theft: fake UPI "₹1 verification" that harvests the UPI PIN; banking SMS/OTP exfiltration
• C2: device registration via a Telegram bot (GhostBatRat_bot); PIN exfil to Firebase
• Extras: emulator/anti-analysis checks; some variants bundle a cryptominer
• Scale: 40+ samples observed from September 2025 onward

The delivery chain

How GhostBat is delivered and where the stolen data goes

The chain is deliberately indirect:

1. Smishing. A WhatsApp or SMS message about a traffic challan carries a shortened URL (tinyurl, short.gy, shorturl.at, cutlink). Short links hide the real destination and are trivially rotated when one gets blocked.
2. A fake update page. The link leads to a page dressed up as a Google Play update or the mParivahan app, which walks the victim into allowing installs from unknown sources.
3. GitHub-hosted APKs. The actual payloads are pulled from raw.githubusercontent.com and GitHub release links, sometimes via compromised websites. Hosting on a trusted developer domain helps the download slip past basic reputation checks.
4. A multi-stage dropper. The APK uses ZIP-header manipulation (changing the compression method to STORE) and native .so packers to frustrate static analysis, then unpacks the real logic.

How it takes the money

Once installed, the app shows a fake mParivahan page asking for a mobile number and vehicle details, then moves to the part that matters: a ₹1 "ownership verification" payment. That leads to a counterfeit UPI interface and a PIN entry screen. The entered UPI PIN is sent to a Firebase endpoint.

At the same time, the app abuses its SMS permissions:

• Messages containing banking keywords are exfiltrated to C2.
• Incoming SMS can be forwarded to an attacker-supplied number, which is how the operators grab OTPs or complete UPI device-binding on their own hardware.

The important mental model: the app doesn't need to defeat your bank. It gets you to hand over the PIN, and it quietly relays the OTP. The bank sees a correctly authenticated transaction.

The tradecraft

GhostBat is more careful than the average fraud APK:

• Anti-analysis. It checks CPU architecture and device manufacturer and terminates on x86/x86_64 (i.e. in many sandboxes and emulators). Strings are heavily obfuscated, payloads are XOR- and AES-decrypted, and native libraries build API names in memory and resolve them at runtime via JNI.
• Telegram for C2. Device registration goes through a Telegram bot, GhostBatRat_bot — the detail that gave the family its name. Telegram bot APIs are a cheap, resilient control channel that blends into normal HTTPS traffic.
• Firebase for exfil. The MITRE mapping in Cyble's report lists Firebase Cloud Messaging for C2 and a Firebase Realtime Database URL for the stolen PIN.
• Cryptomining. Some variants download and run a miner module during execution, squeezing extra value out of the device.
• Low detection. VirusTotal coverage was low at the time of analysis, as is typical for freshly packed samples.

Indicators to hunt for

Cyble published hashes and infrastructure; the types of indicator matter more than any single value, since the operators rotate them constantly:

• Hosting: APK URLs on raw.githubusercontent.com and GitHub release pages; some compromised sites.
• Smishing: shortened URLs (tinyurl, short.gy, shorturl.at, cutlink) in challan-themed messages.
• C2: a Telegram Bot API endpoint for device registration (GhostBatRat_bot); a Firebase Realtime Database URL for PIN exfiltration.
• On-device: an app requesting SMS permissions right after install, then a fake payment flow that asks for a UPI PIN to receive a refund.

Pull the current hashes and URLs straight from the tracker feed or Cyble's report, and feed them to your mobile EDR / MDM and network filtering.

Defence

• For users: never install an app from a challan/bill link, and remember the rule that defeats this entire family — you only ever enter a UPI PIN to send money, never to receive a refund. A ₹1 "verification" that asks for your PIN is theft.
• For banks/fintechs: this malware exists to steal the SMS OTP and the UPI PIN. Reduce reliance on SMS OTP, bind approvals to a device the user actually controls, and risk-score first-time payees. Watch for an OTP read and a transfer completing seconds apart on a newly enrolled device.
• For defenders: Play Protect and modern Android's restrictions on sideloaded apps requesting SMS access blunt this; keep them on. Treat an mParivahan or RTO "app" delivered outside the Play Store as malicious by default.

GhostBat is a reminder that the APK scams draining accounts across India aren't crude. The lure is dumb on purpose; everything behind it is not. The broader ecosystem this sits in — the Telegram storefronts, the resale, the cash-out — is covered in The APK Is the Exploit.

This article reflects public information as of 20 October 2025.

Sources

• Cyble — GhostBat RAT: inside the resurgence of RTO-themed Android malware