A new SOVA malware was recently active by hackers. It packs a new ransomware feature to encrypt files on your mobile.
A new one malware is believed to be operated by hacker that is stealing data from GmailGPay and Google Password Manager Accounts. Dubbed SOVA malware, it is spreading to other online platforms like Bank Online shopping apps and services. According to the report, hackers use the bug to send and steal two-factor authentication (2FA) codes so they can gain access to the Victim’s data. For the non-reversible code, the 2FA code is used to verify that the account is only logged in by the owner. While arguably the most secure way, hackers use SOVA users to overlay a fake screen on the phone screen so they can steal usernames, passwords, and codes.
The scariest thing about this malware is that it uses fake versions of trusted apps, such as Google’s Chrome, Amazon NFT platform or others to infiltrate the device.
What is SOVA Malware?
SOVA malware is an Android Banking Trojan that was first discovered last September. It steals bank data and 2FA codes. Based on Clean, until March 2022, SOVA was found to be responsible for 2FA interception, cookie theft, and injection of new targets. However, in July 2022, SOVA (v4) was found to be targeting over 200 mobile apps, including banking apps and crypto exchanges/wallets. Furthermore, it contains refactored and improved code to work more stealthily on the compromised device. Its latest version, 5.0, even adds ransomware to the device. It uses AES encryption to lock all files in the target device and attach the “.enc” extension on the renamed, encrypted files.
It has recently been found actively growing in the UK, USA, Italy, Spain and Germany. To protect yourself from SOVA malware, you should only download apps from well-known developers and software from trusted sources like the Google Play Store.
One must avoid downloading or clicking on any links received via text message or social media.
