🚨 Your payment app looks normal. An invisible layer is recording your PIN.

Cyble found GhostBat abusing Accessibility on infected Android phones to capture and replay PIN taps in Google Pay and MobiKwik in India. It starts with a fake traffic-fine APK. 60 financial apps appear on its wider target list. Losses from this variant remain unconfirmed. Don’t install apps from traffic-fine texts or grant them Accessibility access. 🕵🏾‍♂️ Security First. Hype Last.