Loading story…
GhostBat RAT is a sophisticated Android malware campaign that has recently targeted users in India by impersonating Regional Transport Office (RTO) applications. Attackers distribute the malware through socially engineered messages, including WhatsApp and SMS, which contain shortened URLs leading to malicious APK files hosted on platforms like GitHub and compromised websites. Once a user installs the fake RTO app, GhostBat deploys a multi-stage dropper mechanism, utilizing obfuscation and native libraries to evade detection by static and heuristic-based security solutions. The malware presents convincing fake update prompts and overlay screens that mimic legitimate services such as mParivahan, tricking users into granting sensitive permissions like SMS access and overlay control. Upon obtaining these permissions, GhostBat is capable of harvesting banking credentials, SMS messages, and device identifiers, posing a significant risk to victims' financial and personal data. The campaign's use of Telegram bots for command-and-control (C2) communications allows attackers to remotely manage infected devices and exfiltrate stolen information efficiently. Security researchers have noted that GhostBat's modular architecture enables it to dynamically load additional payloads, further complicating detection and analysis. The campaign marks a resurgence in localized impersonation attacks, leveraging the high trust Indian users place in official RTO apps. Zimperium's Mobile Threat Defense (MTD) and zDefend solutions have demonstrated the ability to detect GhostBat's indicators of compromise (IOCs) on-device, even before public disclosure, highlighting the importance of advanced mobile security. On September 29, 2025, Zimperium detected an instance of GhostBat on a protected device, underscoring the malware's active deployment prior to widespread awareness. The attackers' strategy of combining trusted social engineering vectors with advanced evasion techniques makes the campaign particularly challenging to counter. Security experts recommend that organizations and individuals remain vigilant against unsolicited messages prompting app installations, especially those purporting to be from government agencies. The use of multi-stage droppers and dynamic code loading in GhostBat exemplifies the evolving tactics of Android malware authors. The campaign's reliance on Telegram for C2 communications also reflects a broader trend of leveraging popular messaging platforms for malicious purposes. The incident underscores the need for robust, on-device mobile threat detection capable of identifying both known and unknown malware variants. Organizations are urged to educate users about the risks of installing apps from unofficial sources and to implement mobile security solutions that can detect sophisticated threats like GhostBat. The GhostBat campaign serves as a warning about the increasing complexity and localization of Android malware targeting specific user populations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Security researchers reported that GhostBat infections were being registered through a Telegram bot named "GhostBatRat_bot" and documented the malware's evasion techniques, including ZIP header manipulation, string obfuscation, native code execution, anti-emulation, and encrypted payload execution via a native C/C++ packer. Multiple outlets published analyses of the campaign on the same day, reflecting a single disclosure event.
A reemergent GhostBat RAT campaign began targeting Android users in India through malicious APKs distributed via hacked websites, WhatsApp, and SMS. The apps impersonated Indian Regional Transport Office services, including a fake mParivahan app, to steal UPI PINs and harvest banking-related SMS messages.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityonline.info
Open sourcezimperium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding a surge in sophisticated spyware campaigns targeting users of popular mobile messaging applications such as Signal, WhatsApp, and Telegram. Threat actors are leveraging commercial spyware and remote access trojans (RATs), employing tactics like social engineering, device-linking QR codes, zero-click exploits, and spoofed app versions to compromise high-value individuals, including government officials. Notable campaigns include the use of Android spyware like ProSpy, ToSpy, and ClayRat, as well as the exploitation of vulnerabilities in iOS, WhatsApp, and Samsung devices to deploy malware such as LANDFALL, with the goal of persistent access and data exfiltration. In a related development, researchers at Certo Software have identified a new Android RAT dubbed RadzaRat, which masquerades as a legitimate file manager app. RadzaRat provides attackers with full remote control over infected devices, supports large-scale file transfers, and features keylogging capabilities to steal sensitive information. Alarmingly, RadzaRat is currently undetectable by all major antivirus solutions and is openly available for download, increasing the risk of widespread abuse. These findings underscore the growing threat posed by advanced spyware and RATs targeting mobile platforms, often bypassing traditional security defenses and exploiting user trust in legitimate-looking applications.
Jun 29, 2026
A sophisticated Android spyware campaign known as ClayRat has been identified targeting users in Russia by masquerading as popular applications such as WhatsApp, Google Photos, TikTok, and YouTube. Attackers employ a combination of phishing websites and Telegram channels to lure victims into downloading malicious APK files, often by imitating official app pages and inflating download statistics with fake testimonials. Once installed, ClayRat grants attackers extensive control over the infected device, enabling them to exfiltrate sensitive data including SMS messages, call logs, device information, and notifications. The spyware can also covertly take photos using the device’s front camera and initiate calls or send SMS messages without user consent. Researchers from Zimperium’s zLabs have observed that the malware propagates aggressively by sending malicious links to every contact in the victim’s phone book, leveraging compromised devices as distribution vectors. Over a three-month period, more than 600 unique samples and 50 dropper variants have been detected, with each iteration incorporating new obfuscation techniques to evade security defenses. Some versions of ClayRat act as droppers, presenting a fake Play Store update screen while installing the actual encrypted payload in the background. The campaign exploits Android’s default SMS handler role to bypass platform restrictions and facilitate rapid spread. In certain cases, fake websites offer a counterfeit “YouTube Plus” app with purported premium features, further enticing users to sideload the malware. The attackers’ use of Telegram channels, such as @baikalmoscow, as distribution hubs is notable for its effectiveness in social engineering. The campaign’s rapid evolution and high volume of unique samples indicate a well-resourced and persistent threat actor. Security researchers emphasize the importance of user vigilance, as the malware’s ability to bypass Google’s sideloading protections on Android 13 and later poses a significant risk. The campaign’s focus on Russian users suggests a degree of regional targeting, though the techniques employed could be adapted for broader attacks. The use of fake positive feedback and inflated download numbers on Telegram channels is designed to build trust and lower user skepticism. The technical sophistication of ClayRat, including its modular dropper architecture and obfuscation layers, presents challenges for traditional mobile security solutions. Organizations and individuals are advised to avoid downloading APKs from unofficial sources and to monitor for unusual device behavior. The ongoing development and distribution of ClayRat underscore the evolving threat landscape facing Android users, particularly in regions where sideloading is more common.
Jun 29, 2026
Researchers have identified new Android malware campaigns targeting users in India, with a focus on financial fraud and surveillance. The NexusRoute remote access trojan (RAT) was discovered impersonating the Indian e-Challan app and leveraging GitHub for distribution, enabling attackers to conduct UPI fraud and monitor victims' activities. In a separate but related campaign, the FvncBot Android banking trojan masquerades as a legitimate banking-security application, exploiting accessibility and VNC features to capture keystrokes, stream device screens, and inject fraudulent transactions directly from compromised devices. Both malware strains are notable for their ability to operate within genuine banking apps, allowing them to bypass traditional security checks and evade detection. These campaigns highlight the increasing sophistication of mobile threats in India, particularly those targeting financial transactions and personal data. Security experts recommend minimizing app permissions, sourcing apps only from trusted platforms, and implementing real-time behavioral monitoring to mitigate the risks posed by such advanced mobile malware.
Jun 29, 2026