GhostBat RAT now watches 60 Indian finance apps for PINs, Cyble reports
Cyble says GhostBat RAT, spread by fake mParivahan and eChallan traffic-fine texts, now monitors 60 Indian banking, UPI and wallet apps for PINs. Its invisible-keypad overlay targets only Google Pay and MobiKwik.
Reality
- Evidence50
- Adoption20
- Hype gap+10
- Incentives40
- Confidence55
Banks expand behavioural checks before mobile payments are authorised
Banking scams targeting mobile users rose 35% in 12 months, according to research cited by Tech Radar. Because victims send the money themselves, banks are looking for signs of manipulation before a payment is authorised.
Reality
- Evidence28
- Adoption
- Not scored
- Hype gap+25
- Incentives
- Not scored
- Confidence32
BioCatch counts a 258% rise in employment scam victims at more than 370 banks
BioCatch says employment scam victims rose 258% in a year at more than 370 banks in 21 countries, against 35% growth for all reported scams. Nine in ten scam sessions now start on a phone, so the signs of a coached victim have to be read inside the mobile session.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+15
- Incentives65
- Confidence50
ThreatFabric says the Android spyware encrypts stolen data and relays it over Wi-Fi Direct and Bluetooth when it cannot reach its C2, using up to four hops by default.
Perspective Coverage
4 publishers
- Builder
- Builder 36%
- Operator
- Operator 58%
- Investor
- Investor 6%
Reality
- Evidence65
- Adoption
- Not scored
- Hype gap+20
- Incentives35
- Confidence68
Group-IB says a second app sets up the work profile within minutes of infection and clones a fake bank app into it, so the malware check inside that app looks at an empty room while the trojan runs in the personal space.
Perspective Coverage
3 publishers
- Builder
- Builder 23%
- Operator
- Operator 67%
- Investor
- Investor 10%
Reality
- Evidence55
- Adoption30
- Hype gap+15
- Incentives50
- Confidence60
buildOne report1 publisher Gigabud clones a banking app into an Android work profile to register a new device
The malware asks for accessibility, then has a second component build a work profile and copy the bank app into it. Group-IB says the clone registers with the bank as a new device while a black screen hides the transfer.
Reality
- Evidence42
- Adoption38
- Hype gap+12
- Incentives34
- Confidence48
Meta ads drove nearly 15,000 PanDa RAT installs in Mexico in one week
Intel 471 found an unauthenticated panel called AppPanda running fake streaming lures behind paid Facebook ads, with affiliate tooling that re-signs the Android payload every hour and tracks ad spend the way a growth team would.
Reality
- Evidence64
- Adoption74
- Hype gap+15
- Incentives58
- Confidence56