Bitget App
Trade smarter
Buy cryptoMarketsTradeFuturesEarnWeb3SquareMore
Trade
Spot
Buy and sell crypto with ease
Margin
Amplify your capital and maximize fund efficiency
Onchain
Going Onchain, without going Onchain!
Convert & block trade
Convert crypto with one click and zero fees
Explore
Launchhub
Gain the edge early and start winning
Copy
Copy elite trader with one click
Bots
Simple, fast, and reliable AI trading bot
Trade
USDT-M Futures
Futures settled in USDT
USDC-M Futures
Futures settled in USDC
Coin-M Futures
Futures settled in cryptocurrencies
Explore
Futures guide
A beginner-to-advanced journey in futures trading
Futures promotions
Generous rewards await
Overview
A variety of products to grow your assets
Simple Earn
Deposit and withdraw anytime to earn flexible returns with zero risk
On-chain Earn
Earn profits daily without risking principal
Structured Earn
Robust financial innovation to navigate market swings
VIP and Wealth Management
Premium services for smart wealth management
Loans
Flexible borrowing with high fund security
Hackers Exploiting WhatsApp To Steal Bank Customers’ Credentials, Warns Cybersecurity Researchers

Hackers Exploiting WhatsApp To Steal Bank Customers’ Credentials, Warns Cybersecurity Researchers

Daily HodlDaily Hodl2025/10/17 16:00
By:by Alex Richardson

Cybersecurity researchers are warning about a dangerous new malware strain that targets banking customers by exploiting WhatsApp and SMS.

Dubbed “GhostBat RAT,” the malicious software masquerades as legitimate government-related apps, tricking users into downloading infected Android files from GitHub or compromised websites.

According to the team at Cyble , the malware campaign has resurged in India with alarming sophistication, using shortened URLs in WhatsApp messages and text alerts to deceive victims into believing they’re installing official transportation apps.

Once installed, GhostBat RAT deploys a phishing overlay that captures sensitive information including mobile banking credentials, UPI PINs, and account details. It also intercepts SMS messages containing banking-related keywords to siphon one-time passwords and two-factor authentication codes, giving attackers full access to victims’ financial accounts.

Researchers found that the malware communicates with a remote command-and-control server to exfiltrate stolen data in real time, while also granting attackers the ability to monitor user activity, send messages, and modify system settings.

Cyble says that the campaign leverages social engineering tactics to build trust and gain permissions that bypass Android’s default security safeguards.

The firm has urged users to remain vigilant, avoid downloading applications from unofficial links, and verify the authenticity of app publishers before installation. Security experts also recommend reviewing app permissions, updating Android systems regularly, and using reliable mobile antivirus tools.

“The GhostBat RAT campaign represents a sophisticated evolution of RTO-themed Android malware. It combines multi-stage dropper techniques, anti-analysis defenses, native code exploitation, and social engineering to compromise users.

By targeting both banking credentials and UPI authentication flows, the malware demonstrates an ability to extract financial information directly while evading traditional detection mechanisms.”

Generated Image: Midjourney

0

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

PoolX: Earn new token airdrops
Lock your assets and earn 10%+ APR
Lock now!