A text message about an unpaid traffic challan could cost Android users in India far more than a fine. GhostBat RAT, an Android malware strain first identified by cybersecurity firm Cyble in October 2025, has evolved to capture PINs from 60 banking, UPI apps, wallet and fintech applications, according to new research published by Cyble. The firm's investigation into fake mParivahan and eChallan apps also exposed a wider operator-controlled ecosystem it tracks as GhostX, linking phishing pages, backend control systems and malware distribution.

How GhostBat RAT Reaches Victims

The malware spreads mainly through smishing, or SMS phishing. Victims receive messages with malicious links that lead to pages impersonating the official Parivahan service or a Google Play-style download page. These pages push users to install a fraudulent mParivahan APK. Researchers also found GitHub repositories being repeatedly used to host the malicious files. Many of these apps are only first-stage loaders. The real payload stays hidden in encrypted files or is downloaded later, which makes the app look harmless during an initial scan. [caption id="attachment_114830" align="aligncenter" width="600"] GhostBat-RAT-Infection-Chain-1536x595[/caption]

GhostBat RAT's Ghost Overlay Trick

The most significant change in the latest variant is its abuse of Android's Accessibility Service, a technique commonly linked to modern Android banking trojan families. Earlier variants analyzed by Cyble did not have this capability. Its standout feature, called Ghost Overlay, targets Google Pay and MobiKwik. Instead of showing a fake login screen, the malware places an invisible 12-key grid over the real PIN keypad. When a user taps a digit, the overlay records it and then replays the same tap into the genuine app. The payment goes through normally, so the victim has no visible reason to suspect anything, while the PIN is quietly sent to the attackers' server.

GhostBat RAT Watches 60 Financial Apps

Beyond Google Pay and MobiKwik, a broader keylogging feature monitors 60 financial apps. Cyble's list includes PhonePe, Paytm, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge, PayZapp, Groww, Navi, Jupiter, OneCard, JioFinance and Samsung Pay. The malware checks which app is open and the screen context before treating numeric input as a possible PIN. This builds on older capabilities that remain in play, including reading SMS messages and OTPs, manipulating call forwarding, collecting call logs and sending SMS messages through the victim's SIM card, which could be used to spread further smishing campaigns.

Inside the GhostX Network Behind GhostBat RAT

A key finding came from an exposed Firebase backend named "ghostx-panel." It contained administrator records, user roles, login logs with device fingerprints and bot-user mappings. Cyble says these separate roles point to a multi-operator setup and raise the possibility of a Malware-as-a-Service model. While monitoring the backend, researchers saw SMS lure text, phishing links, vehicle registration numbers and recipient phone numbers changing repeatedly, indicating an active campaign. Matching eChallan messages were also reported by users on social media.

Why GhostBat RAT Is Hard to Detect

Cyble identified at least six different loader designs. The newest, built around a native library called libnetbridge.so, passes the payload through several layers of encryption, compression and custom packaging before the final app appears. Security tools that scan only the outer APK are unlikely to catch it consistently. The malware also uses Firebase Remote Config, which lets operators switch command servers and turn features on or off remotely without pushing a new app to victims.

Staying Safe From GhostBat RAT

Cyble advises users to install apps only from official stores such as Google Play and to avoid APK links received by SMS, social media or email. Users should be cautious about granting app permissions, especially Accessibility access, verify website addresses before entering sensitive details, enable multi-factor authentication on financial apps and keep their phones updated. Anyone who suspects infection should contact their bank and local authorities immediately.

A text alert about an undelivered package or an unpaid toll may look like a one-off scam. A new Microsoft cybercrime crackdown shows it is often the visible end of a much larger operation. Microsoft and Health-ISAC, a global non-profit that helps health sector organizations share cyber threat information and improve operational resilience, have moved to dismantle three services, YAM Store, CoGUI and Iron Man, that supplied criminals worldwide with accounts, hosting and tools to build fake websites and online identities. Since January 2026, the three services have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide. More than 750 million of those messages were aimed at Microsoft customers alone. Consumers, healthcare organizations, financial institutions and other businesses in more than 150 countries were targeted, generating tens of millions of dollars for the operators.

How the Microsoft Cybercrime Crackdown Began

The investigation started in late 2025 after Japan's National Police Agency (NPA) alerted Microsoft to malicious messaging campaigns targeting people in Japan. The NPA continued providing intelligence and investigative support throughout the probe as partners traced those campaigns back to the businesses supplying criminals around the world. Investigators expected to find individual campaigns. Instead, they traced the activity to a sprawling Chinese-language marketplace that was difficult for non-native-speaking investigators to penetrate. The probe widened to include the Japan Cybercrime Control Center (JC3), Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs. Drawing on its network of more than 130 member organizations, JC3 linked what appeared to be separate incidents into a broader pattern of scams against Japanese companies and financial institutions. Health-ISAC provided insight into the impact on healthcare organizations.

What the Microsoft Cybercrime Crackdown Uncovered

YAM Store operated much like an online shop. Customers could browse products, compare prices and buy fraudulent Microsoft and Google accounts along with ready-made scam tools, including those used for credential theft. Controlled purchases by Microsoft helped confirm how it worked. In some cases, operators bought internet domains that legitimate organizations had allowed to expire, often in sectors such as non-profits and education, with specialized product offerings for those sectors. They rebuilt the websites to make those organizations appear active, then used them to fraudulently obtain Microsoft 365 accounts for resale. The infrastructure sold through YAM Store was frequently paired with CoGUI. This service supplied ready-made websites and messages impersonating companies, banks, government agencies and other trusted organizations. Rather than build fraudulent sites themselves, criminals could quickly deploy pages designed to steal passwords, payment details and personal data. CoGUI became one of the most widely used offerings in the ecosystem, particularly targeting victims in Japan and the United States. [caption id="attachment_114817" align="aligncenter" width="600"] Image Source: https://blogs.microsoft.com/[/caption] By mid-2026, CoGUI was increasingly being replaced by Iron Man, which offered thousands of phishing templates tailored to specific brands, industries and countries. Criminals could use them to quickly deploy email, text and web content. Through test purchases and work with Resecurity, investigators identified more than 2,300 templates impersonating banks, retailers, healthcare providers, transportation authorities, police departments and government agencies across more than 150 countries. Others mimicked airlines, telecommunications companies and parcel delivery services. Some were built for government impersonation scams, using the look of official authority to pressure victims into paying or sharing sensitive information. Microsoft noted that an organization appearing in these templates does not mean its systems were compromised.

Court Order Backs Microsoft Cybercrime Crackdown

Acting on an order from the United States District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains that formed part of the infrastructure behind the three services. Microsoft has disabled more than 20,000 accounts linked to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud, while removing infrastructure hosted on its services. Microsoft also shared intelligence with the U.S. Secret Service and international law enforcement partners. Investigators used AI tools to connect accounts, websites and infrastructure that initially appeared unrelated. The case reflects a trend highlighted in this year's Microsoft Digital Defense Report: modern fraud increasingly relies on businesses and services that help criminals reach more victims. No single organization saw the full picture of this transnational cybercrime network, and uncovering it required two-way information sharing across industries and borders. YAM Store, CoGUI and Iron Man are only part of a larger criminal ecosystem. Still, the Microsoft cybercrime crackdown makes it harder for criminals to obtain the accounts, tools and infrastructure that keep scam messages flowing. Microsoft Threat Intelligence has published a blog with further details on the network and steps customers can take to protect themselves.

The OLVX marketplace, an illicit online platform used to sell stolen personal data, login credentials and cybercrime tools, has been dismantled following a coordinated investigation by North Macedonia’s Ministry of Interior and the US Federal Bureau of Investigation (FBI). Authorities have filed criminal charges against a 20-year-old suspect from the Tetovo area, alleging involvement in computer fraud, misuse of personal data and the production and distribution of child sexual abuse material. According to North Macedonia’s Ministry of Interior, the Cybercrime and Digital Forensics Sector submitted the charges against E.A., from the village of Golema Rečica, to the Basic Public Prosecutor’s Office in Tetovo. The investigation focused on the suspect’s alleged administration of the OLVX marketplace, which operated between 2023 and 2025. The operation began after the FBI provided intelligence that prompted a joint investigation into the platform and its associated criminal activities.

OLVX Marketplace Offered More Than 1,500 Stolen Login Credentials

Evidence gathered during the investigation indicated that the suspect administered domains and websites associated with OLVX between 2023 and 2025. The platform functioned as a cybercrime marketplace, where users could buy and sell stolen digital information, software tools and services intended to facilitate criminal activity. The marketplace primarily served cybercriminals seeking personal information and stolen login credentials that could provide access to victims’ online accounts and computer networks. During its operation, more than 1,500 sets of stolen login credentials were offered for sale, according to the authorities. The platform also used a cryptocurrency-based payment arrangement. Rather than operating an escrow service, as many underground marketplaces do, OLVX allowed users to load funds onto the site and use those funds to pay one another. The arrangement provided an alternative payment mechanism for transactions conducted through the platform.

Telegram Group Allegedly Offered Cybercrime Tools

The investigation also examined the suspect’s alleged activities on Telegram. Authorities said that between 2025 and 2026, the suspect administered an illicit online group called ONEMILI, which offered software tools and services designed to facilitate cybercrime. These included fraudulent refund schemes, according to the Ministry of Interior. Investigators also obtained evidence indicating that the suspect had acquired and possessed child sexual abuse material (CSAM) for personal use through Telegram. The allegations form part of the criminal charges filed with the prosecutor’s office. The available information does not specify whether the suspect has been arrested or whether court proceedings have begun.

FBI Investigation Highlights Cross-Border Cybercrime Enforcement

The operation marks the first jointly coordinated cybercrime operation between North Macedonia’s Ministry of Interior and the FBI, according to the ministry. The case demonstrates how intelligence sharing between law enforcement agencies can support investigations into online platforms operating across jurisdictions. Authorities have increasingly targeted illicit online marketplaces that facilitate the exchange of stolen information, cybercrime tools and tactics. Over the past five years, law enforcement agencies have taken down dozens of such marketplaces, which have become focal points for cybercriminals trading data and services. In a separate development, Microsoft announced the takedown of three popular Chinese phishing sites used by cybercriminals to send hundreds of millions of malicious messages impersonating more than 75,000 organizations worldwide. Although the cases involve different platforms and activities, both illustrate law enforcement and technology companies’ efforts to disrupt online infrastructure used for cybercrime. The North Macedonia investigation highlights the role of international cooperation in identifying platform administrators and disrupting services linked to the trade in stolen data. The Ministry of Interior said its Cybercrime and Digital Forensics Sector would continue working to combat cybercrime, protect personal data and improve digital safety.