JupiterMalware
- earlyrat
Last reported 9 days ago, by Cyble1 report
ATT&CK techniques
6 of 11 · each with the sentence it comes from- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Software Packing (T1406.002)”
- T1027.002Software Packing
“Obfuscated Files or Information: Software Packing (T1406.002)”
- T1036Masquerading
“Masquerading: Match Legitimate Name or Location (T1655.001)”
- T1056Input Capture
“The malware now abuses the Android Accessibility Service to support Ghost Overlay and broader PIN/key-input capture targeting financial applications used across India.”
- T1056.001Keylogging
“Additionally, the malware implements a PIN-capture capability through keylogging, targeting 60 Android applications across India’s banking, UPI, wallet, fintech, and digital payment ecosystem.”
- T1056.002GUI Input Capture
“Input Capture: GUI Input Capture (T1417.002)”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
The GhostX Ecosystem: Forged in Transit, Licensed to Deceive“…ations associated with Google Pay, PhonePe, Paytm, MobiKwik, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge, PayZapp, Groww, Navi, Jupiter, OneCard, JioFinance, Samsung Pay, and several other banking and payment services.”
Indicators in its reports
named in the reports above- hxxps://api.cloudsettle[.]org/pin-data%E2%80%9Din 1 report
- api.cloudsettle[.]orgin 1 report
- hxxps://api.cloudsettle[.]orgin 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.