Govt warns Indian banking users of new type of malware targeting customers through more than 200 mobile apps

way2barak, Sept.18: The government’s ‘Indian Computer Emergency Response Team’ (CERT-In), an agency under the Ministry of Electronics and Information Technology has issued a warning against ‘SOVA’ Android Trojan, a new type of malware campaign targeting Indian banking customers through more than 200 mobile apps.

The latest version of SOVA malware hides itself through the Android app. It hides itself by using the logo of popular apps like Chrome, Amazon, NFT platform. Because of this people install it in the device. After this the virus becomes active and starts targeting people. This malware steals the login details of the users when they login to their net banking apps to access the banking account. According to the report, this malware is being spread through SMS phishing.

“Once the fake android application is installed on the phone, it sends the list of all applications installed on the device to the C2 (command and control server) controlled by the threat actor in order to obtain the list of targeted applications. At this point, the C2 sends back to the malware the list of addresses for each targeted application and stores this information inside an XML file. These targeted applications are then managed through the communications between the malware and the C2.” CERT-In said. It captures users’ credentials when they log into their net-banking apps and access their bank accounts.

In order to stay safe from the virus, CERT-In also suggested some best practices. The measures include-reduce the risk of downloading potentially harmful apps by limiting their download sources to official app stores. Verify app permissions and grant only those which have relevant context for the app’s purpose. Install Android updates and patches and not browse un-trusted, among others