diff --git a/pkgs/tools/security/ghost/default.nix b/pkgs/tools/security/ghost/default.nix
new file mode 100644
index 00000000000..124caef45c2
--- /dev/null
+++ b/pkgs/tools/security/ghost/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "ghost";
+  version = "8.0.0";
+
+  disabled = python3.pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "EntySec";
+    repo = "Ghost";
+    rev = version;
+    sha256 = "13p3inw7v55na8438awr692v9vb7zgf5ggxpha9r3m8vfm3sb4iz";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    adb-shell
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "ghost" ];
+
+  meta = with lib; {
+    description = "Android post-exploitation framework";
+    homepage = "https://github.com/EntySec/ghost";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f7a38a408f8..10b09dd1740 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5303,6 +5303,8 @@ with pkgs;
 
   ghorg = callPackage ../applications/version-management/git-and-tools/ghorg { };
 
+  ghost = callPackage ../tools/security/ghost { };
+
   ghostunnel = callPackage ../tools/networking/ghostunnel { };
 
   ghq = callPackage ../applications/version-management/git-and-tools/ghq { };