The GhostX Ecosystem: Forged in Transit, Licensed to Deceive

Executive Summary Cyble has continued tracking GhostBat RAT activity targeting Android users in India since its initial identification in October 2025 . Recent investigations into malicious mParivahan and eChallan-themed applications revealed a broader operator-controlled ecosystem that we track as GhostX. Analysis of the exposed GhostX backend identified administrative and user-management structures, device-control records, SMS-delivery instructions, call-forwarding activity, and continuously changing phishing content , indicating active campaign management.