Loading story…
Indian authorities ordered the blocking of seven battery management system mobile apps, including BAT-BMS, after they were abused to remotely disable electric rickshaws and some e-scooters by connecting over Bluetooth to compatible lithium batteries. The misuse spread through viral videos and a prank trend known as the Tirri Challenge, leaving drivers stranded in traffic and causing service disruptions in multiple locations. Officials also linked the capability to extortion, including a case in Ujjain, Madhya Pradesh, where police arrested a suspect accused of immobilizing e-rickshaws and demanding payment from drivers.
The Ministry of Electronics and Information Technology directed Google and Apple to remove the identified apps from their Indian app stores and warned marketplaces to apply greater due diligence where public safety is at risk. The action does not fully eliminate the threat, however, because the apps may still be available through third-party stores or alternate store regions, and vulnerable battery systems can still be accessed over Bluetooth if they lack password or PIN protection. The incident has intensified scrutiny of missing cybersecurity requirements in India’s e-rickshaw certification standards and the broader risks posed by connected electric mobility systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The Indian central government is preparing new cybersecurity regulations for electric two- and three-wheelers to address unauthorized battery and software tampering. Proposed measures include stronger software security requirements, possible restrictions on exploitable mobile apps, and linking future roadworthiness certification to the absence of such vulnerabilities.
The Indian government ordered the blocking of seven battery management system mobile applications after determining they were being misused to remotely disable batteries in electric vehicles and e-rickshaws. MeitY directed Google and Apple to remove the identified apps from their Android and iOS app stores in India.
In Ujjain, Madhya Pradesh, police arrested a suspect accused of remotely immobilizing e-rickshaws and demanding payment from drivers. The arrest tied the battery-disabling abuse to a criminal extortion scheme rather than only prank activity.
Attackers and pranksters misused the legitimate Bluetooth-enabled BAT-BMS battery management app to connect to compatible lithium batteries and shut down e-rickshaws, causing service disruptions in multiple locations in India. Some incidents also reportedly affected e-scooters, and the abuse was linked to extortion in at least one case.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcenews.risky.biz
Open sourcecysecurity.news
Open sourceasec.ahnlab.com
Open sourcecloud.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GhostBat RAT is a sophisticated Android malware campaign that has recently targeted users in India by impersonating Regional Transport Office (RTO) applications. Attackers distribute the malware through socially engineered messages, including WhatsApp and SMS, which contain shortened URLs leading to malicious APK files hosted on platforms like GitHub and compromised websites. Once a user installs the fake RTO app, GhostBat deploys a multi-stage dropper mechanism, utilizing obfuscation and native libraries to evade detection by static and heuristic-based security solutions. The malware presents convincing fake update prompts and overlay screens that mimic legitimate services such as mParivahan, tricking users into granting sensitive permissions like SMS access and overlay control. Upon obtaining these permissions, GhostBat is capable of harvesting banking credentials, SMS messages, and device identifiers, posing a significant risk to victims' financial and personal data. The campaign's use of Telegram bots for command-and-control (C2) communications allows attackers to remotely manage infected devices and exfiltrate stolen information efficiently. Security researchers have noted that GhostBat's modular architecture enables it to dynamically load additional payloads, further complicating detection and analysis. The campaign marks a resurgence in localized impersonation attacks, leveraging the high trust Indian users place in official RTO apps. Zimperium's Mobile Threat Defense (MTD) and zDefend solutions have demonstrated the ability to detect GhostBat's indicators of compromise (IOCs) on-device, even before public disclosure, highlighting the importance of advanced mobile security. On September 29, 2025, Zimperium detected an instance of GhostBat on a protected device, underscoring the malware's active deployment prior to widespread awareness. The attackers' strategy of combining trusted social engineering vectors with advanced evasion techniques makes the campaign particularly challenging to counter. Security experts recommend that organizations and individuals remain vigilant against unsolicited messages prompting app installations, especially those purporting to be from government agencies. The use of multi-stage droppers and dynamic code loading in GhostBat exemplifies the evolving tactics of Android malware authors. The campaign's reliance on Telegram for C2 communications also reflects a broader trend of leveraging popular messaging platforms for malicious purposes. The incident underscores the need for robust, on-device mobile threat detection capable of identifying both known and unknown malware variants. Organizations are urged to educate users about the risks of installing apps from unofficial sources and to implement mobile security solutions that can detect sophisticated threats like GhostBat. The GhostBat campaign serves as a warning about the increasing complexity and localization of Android malware targeting specific user populations.
Jun 29, 2026
Security researchers reported serious Bluetooth security weaknesses in personal mobility devices that allow unauthorized control at close range. An Estonian researcher reverse-engineered Äike’s app-controlled e-scooters after the company’s bankruptcy and alleged the scooters shipped with a single default/private “master” key rather than unique per-device secrets, enabling anyone who derives the key to generate valid challenge-response authentication and unlock/control any scooter model the company sold. Separately, researchers demonstrated remote control of **WHILL** wheelchairs over Bluetooth, prompting a **CISA advisory** stating the devices did not enforce authentication for Bluetooth connections. An attacker within Bluetooth range could pair without credentials or user interaction and then control movement, override speed restrictions, and alter configuration profiles—highlighting a broader risk pattern where weak or missing Bluetooth authentication in mobility/IoT products can translate directly into physical safety impacts.
Jun 29, 2026
India's telecommunications ministry has issued a directive requiring all major smartphone manufacturers, including Apple, Samsung, Vivo, Oppo, and Xiaomi, to preload a government-backed cybersecurity app called Sanchar Saathi on all new devices within 90 days. The app, which cannot be deleted or disabled by users, is designed to combat telecom fraud, spam, and malicious activity by allowing users to report suspicious calls, block stolen handsets, and monitor the number of mobile connections registered in their name. The government order also mandates that devices already in the supply chain receive the app via a software update, raising concerns among industry players and privacy advocates about the lack of prior consultation and potential privacy implications. Sanchar Saathi has already been installed over 11.4 million times and has played a significant role in blocking more than 4.2 million lost devices and recovering over 700,000 phones since its launch. The app's features include the ability to report international calls spoofed as domestic, helping authorities crack down on illegal telecom exchanges that facilitate scams and pose national security risks. The move underscores India's efforts to strengthen telecom cybersecurity amid a rapidly growing mobile user base exceeding 1.2 billion subscribers, but it also places the country alongside others like Russia in mandating pre-installed government software on consumer devices.
Jun 29, 2026