Executive Summary Cyble has continued tracking GhostBat RAT activity targeting Android users in India since its initial identification in October 2025. Recent investigations into malicious mParivahan and eChallan-themed applications revealed a broader operator-controlled ecosystem that we track as GhostX.
The GhostX Ecosystem: Forged in Transit, Licensed to Deceive
About this summary. This is a short, independently written summary of an article first published by Cyble. Cyber Security News did not report or verify the underlying story. Read the original: https://cyble.com/blog/ghostx-forged-in-transit-licensed-to-deceive/
Source attribution: headline and facts are from Cyble (cyble.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Hirudo Android Trojan Replaces Banking Apps to Steal Credentials
Android trojan Hirudo replaces genuine banking apps with modified versions to steal credentials and bypass security checks, enabling financial fraud. ThreatFabric…
Google issues Android security updates: who can get them and how
Google has published security fixes for Android. The October updates are available for Android operating system versions 14, 15, 16, 16-qpr2, and 17 where “qpr” stands…
A week in security (September 21 – September 27)
Last week on Malwarebytes Labs: LinkedIn adds new checks for fake profiles and work histories Kothamine malware uses Tailscale’s tailcat to evade network detection…
A week in security (September 14 – September 20)
Last week on Malwarebytes Labs: New Android malware uses AI to steal bank logins and PINs Did an AI really try to break free from human control?
Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies
The Hirudo malware combines elements of a traditional banking trojan and a full-featured RAT.
Chrome for Android Update
Hello Everyone! We've just released Chrome 156 (156.0.8078.39) for Android to a small percentage of users. It'll become available on Google Play over the next few days.