In India, mobile banking applications are being targeted by SOVA, a Trojan virus that is believed to be particularly hazardous for mobile users and may encrypt an Android phone, and is also impossible to remove, according to the most recent warning from India’s Federal Cyber Security Agency.
In July 2022, SOVA’s target countries were widened to include India in addition to the original US, Russia, and Spain targets.
The most recent incarnation of this malware hides behind fraudulent Android applications that display the logos of legitimate products like Google Chrome, Amazon, and NFT (non-fungible tokens tied to the bitcoin platform) to deceive users into installing them.
The malware may gather keystrokes, swipe, click, and other actions via the android accessibility service in addition to taking screenshots, recording video from a webcam, intercepting multi-factor authentication (MFA) tokens, and recording screenshots.
It may also add false overlays to several apps and replicate over 200 banking and payment applications to trick the Android user.
The user’s attempts to delete the virus, whether through the settings or by pressing the icon, are intercepted by SOVA by returning to the home screen and showing a toast (little popup) reading “This app is secured.”
These attack attempts have the potential to jeopardize the security and privacy of important client information, resulting in widespread attacks and financial fraud.
The Indian Computer Emergency Response Team, or CERT, is the federal government’s technical arm to combat cyberattacks and defend the Internet against, among other online assaults, phishing, and hacking attempts.
The group advocated looking over the app permissions and only accepting those that directly relate to the app’s objective.
Regular Android updates and patches should be installed, unauthorized websites and links should not be visited or followed, and links contained in unsolicited emails and messages should be carefully considered before clicking.
To reduce the likelihood of installing potentially dangerous apps, the organization noted that customers should restrict their app downloads to reputable app stores, such as “your device’s maker or operating system app store.”
They should constantly look at the app’s details, download count, user reviews, comments, and more information area.
