What is the SOVA Virus?
19 December, 2022
Beware of the SOVA virus
Today, you can use the internet to conduct your banking from anywhere, at any time. While the digital age allows you to enjoy convenience and speed, your sensitive information and funds also become vulnerable to security threats. When it comes to mobile banking, one such danger is that of viruses. Recently, a new mobile banking virus, the SOVA virus, has been making headlines. Continue reading to learn more about how you can protect yourself from this virus.
What is the SOVA Virus?
SOVA is essentially a virus that can incorporate false overlays into various apps. This allows the virus to mimic more than 200 banking and payment apps. It is a mobile banking virus specifically targeting Android devices.
Earlier, the virus was predominantly found in countries like the USA, Russia, etc. However, since July 2022, it has spread to numerous other countries, including India. The Indian cyber security agency CERT (Computer Emergency Response Team) also issued an advisory warning that the virus has updated to its fifth version since it was found in the Indian cyberspace.
The latest version of the virus is harmful because it manages to con an average Android user. The malware hides within fake Android applications that appear legitimate. Users get tricked by legitimate-looking logos and they could end up installing the apps with malware hidden inside.
CERT-In has clarified that the virus is distributed via smishing. Smishing is when scammers execute phishing attacks via SMS. The virus is deemed dangerous because it can collect data like keystrokes, cookies, and multi-factor authentication tokens, take screenshots and record videos. It can also perform actions like clicking, swiping, etc., via the Android accessibility service.
Apart from the offensive tactics, the virus also refactors the protection module. So, it protects itself from any action taken by a victim. For instance, if you try to uninstall the app, the virus can intercept such a move and prevent uninstallation.
Once you install the app on your phone, it can gather information related to the other applications on the device and send it to the C2 (command and control server). The C2 is handled by the threat actor and is used to procure a list of targeted applications. The C2 and the malware can then manage these targeted applications, including mobile banking portals.
Tips to prevent SOVA virus from taking over your device?
Although the SOVA virus sounds intimidating, there are measures you can take to protect yourself. Here are some tips for doing the same as suggested by CERT-In:
Avoid downloading any applications that appear suspect or potentially harmful.
Download apps from official application stores or the device manufacturer’s store.
Make sure to check the app’s details, download frequency, and reviews to certify that you are not downloading anything dangerous.
Review app permissions and only grant access to information that is relevant to the purpose of the application.
Keep installing Android updates regularly for security purposes.
Do not browse websites that seem untrustworthy and refrain from clicking on links that seem suspect, especially if you receive any via unsolicited SMSes and emails.
Now that you know more about the tips to prevent the SOVA virus, make sure to remain alert at all times.
Read more about Why Online Banking Is Safer Than You Think here.
*Terms and conditions apply. The information provided in this article is generic in nature and for informational purposes only. It is not a substitute for specific advice in your own circumstances.
