What is SOVA Android Banking Malware?

Banking trojan attacks on Android phones jumped from 420,000 in 2023 to 1.24 million in 2024—a 196% surge that highlights the growing threat of mobile malware. At the center of this rise is SOVA, a malware strain that now does more than steal banking credentials.

SOVA has evolved into a dual threat, combining banking trojan tactics with ransomware capabilities. It can both steal sensitive financial data and encrypt files on infected devices, locking users out until a ransom is paid.

In this blog, we’ll explain how SOVA works, the risks it creates, and how your organization can defend against it.

The Evolution of SOVA: Banking Trojan to Ransomware Hybrid

SOVA emerged in August 2021 as an Android banking trojan that utilized overlay attacks to steal user credentials from banking and cryptocurrency apps.

By 2022, SOVA had transformed into a more formidable threat. The malware's fifth version introduced ransomware capabilities, enabling it to encrypt files on infected devices using AES encryption and append a ".enc" extension to the filenames. Victims are then prompted to pay a ransom to regain access to their data.

This evolution signifies SOVA's transition from a credential-stealing trojan to a dual-threat malware, combining financial data theft with data encryption extortion.

How SOVA Infects Devices

SOVA uses a multi-step infection process to infiltrate Android smartphones and avoid detection.

It relies heavily on social engineering, tricking users into installing malicious apps under the guise of legitimate services.

Each step is designed to bypass user suspicion and gain deeper access to device functions and sensitive data.

Step 1: Initial Lure

Attackers start by sending smishing messages (SMS phishing) or sharing malicious QR codes (quishing) that direct users to fake download links These links often impersonate trusted services, such as bank notifications or mobile carrier alerts.

Clicking the link leads users to a page hosting an infected APK file, disguised as a legitimate update or app.

Step 2: App Masquerade

SOVA disguises itself as well-known apps, such as Google Chrome, PayPal, or popular crypto wallets, to trick users into trusting and installing it.

Many users unknowingly download these fake apps, especially when sideloading from links outside the official Google Play Store.

Once installed, SOVA hides in plain sight, using familiar icons and names to avoid raising suspicion.

Step 3: Permission Abuse

After being installed, SOVA prompts users to enable accessibility service permissions, which are designed to help users with disabilities.

By gaining this access, the malware can monitor screen activity, capture keystrokes, and even control the device's interface.

With these powerful permissions, SOVA operates silently in the background, carrying out malicious actions without the user’s knowledge.

Step 4: Overlay Attacks

SOVA uses overlay attacks by placing fake login screens on top of legitimate apps the moment they are opened.

These overlays are designed to look identical to real login pages, tricking users into entering their usernames and passwords.

Believing they're accessing the actual app, users unknowingly hand over their credentials directly to the malware.

Step 5: Data Harvesting & Encryption

Once active, SOVA quietly collects sensitive data, including banking credentials, SMS messages, and multi-factor authentication codes.

After gathering enough information, it activates its ransomware module, encrypting important files on the device with a “.enc” extension.

A ransom note then appears, demanding payment - usually in cryptocurrency - and threatening to permanently lock or leak the stolen data if the demand isn't met.

This detailed infection chain allows SOVA to operate stealthily and cause maximum damage once embedded in a device.

How SOVA’s Ransomware Feature Works

SOVA's ransomware functionality encrypts specific file types, locking users out of their data until a ransom is paid, usually in cryptocurrency. Here’s what makes it especially dangerous:

• File targeting: SOVA scans Android devices for sensitive or critical files and encrypts them using strong encryption algorithms.
• Access denial: Encrypted files are renamed and locked. Victims receive a ransom note with instructions to pay for decryption.
• Double extortion: Attackers may also threaten to leak stolen data such as banking credentials if the ransom is not paid, adding more pressure on the victim.

This combination of financial theft and data encryption gives SOVA powerful leverage over its victims and makes recovery difficult without strong preventive measures.

Impact on Organizations and Individuals

SOVA’s combination of credential theft and ransomware makes it a serious threat for both personal and professional users. It doesn’t just affect a single device—it can disrupt financial stability, compromise sensitive data, and paralyze operations.

The table below highlights how SOVA impacts individuals and organizations differently.

Table 1: Key Differences in SOVA Malware Impact on Individuals and Organizations

SOVA’s dual-threat nature demands urgent attention and proactive defense, especially for organizations with mobile-dependent workflows.

Defending Against SOVA with Keepnet xHRM Platform

Stopping threats like SOVA Android malware requires more than tools—it demands smarter people. The Keepnet Extended Human Risk Management Platform delivers adaptive training, real-world simulations, and automated incident response to reduce human risk and stop mobile attacks at the source.

• Personalized Training Programs: Access over 2,100 materials in 36+ languages, covering smishing, quishing, vishing, and compliance topics.
• AI-Powered Phishing Simulations: Run 6,000+ attack scenarios with instant micro-training triggered by risky user behavior.
• Mobile Security Enforcement: Apply MDM policies to control app use and remotely wipe compromised devices.
• Proactive Threat Detection & Response: Use tools like Email Threat Simulator, Threat Intelligence, and Incident Responder to catch and contain threats quickly.
• Always-On Awareness: Automate posters, screensavers, and infographics to reinforce secure behavior every day.

With Keepnet, you transform your workforce into your first line of defense against mobile threats like SOVA.

The Future of Mobile Malware and SOVA

SOVA's transformation into a dual-threat malware highlights a critical evolution in mobile cyberattacks. It now combines credential theft with ransomware, targeting Android users through phishing, fake apps, and advanced social engineering tactics.

As mobile threats grow in complexity and begin extending into IoT environments, organizations must treat mobile devices as high-risk assets. Applying the same security standards used for desktops and servers is now essential.

To assess your team’s readiness against threats like SOVA, start with Keepnet’s free phishing simulation test—a quick way to identify human vulnerabilities and strengthen your frontline defenses.

Further Reading

Explore related topics to strengthen your mobile security and human risk management strategy:

• Cyber security awareness training for employees
• QR code phishing trends
• The importance of password protection intelligence
• Understanding quishing
• Smishing simulator
• The rise of voice phishing
• Human error in cyber security breaches
• Petya ransomware attack
• Internet of Things (IoT)