Loading story…
The S.O.V.A. Android malware has been documented as a banking trojan and botnet under active development, with samples masquerading as legitimate apps including Adobe Flash Player and Minecraft. Researchers found it targets Android 7 through 11, relies heavily on abused Accessibility, notification listener, and default SMS permissions, and performs regional exclusion checks to avoid devices associated with CIS countries. Once launched, it can register infected devices with command-and-control infrastructure, start multiple background services, hide itself from the app list, resist device locking, and evade analysis through anti-emulation checks.
S.O.V.A. is designed to steal a wide range of data, including banking credentials, cookies, SMS messages, push notifications, clipboard contents, and keystrokes, while also overlaying fake login pages on banking and cryptocurrency applications. Analysis of newer samples showed added botnet-style behavior such as cryptocurrency clipboard hijacking, root-status reporting, encrypted logging using Base64-wrapped RC4, and Retrofit2-based C2 communications, alongside previously observed support for hidden notification interception, SMS sending, and DDoS-related commands. Researchers also noted the malware’s roadmap included broader Android version support, MiTM, ransomware, VNC, Telegram-based C2, and more automated injection features.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
A later analyzed S.O.V.A sample masqueraded as a Minecraft application and was found to be packed and implemented in Kotlin. The sample performed CIS-related exclusion checks, anti-emulation checks, requested accessibility permissions, registered with its C2, and used services for clipboard hijacking, device-state monitoring, SMS interaction, and hiding itself from the app list.
Cyble Research Labs identified the S.O.V.A advertisement during threat hunting and analyzed an APK masquerading as Adobe Flash Player. The analysis documented its abuse of Accessibility, notification listener, and default SMS app permissions, credential-stealing overlays, cookie theft, clipboard capture, SMS abuse, DDoS capability, and C2 communications with xsph[.]ru infrastructure.
An unknown threat actor posted an advertisement for the Android banking trojan S.O.V.A. on the XSS.is forum, describing the malware as under active development. The actor said it currently supported Android 7 through 11 and planned features including Android 12 support, man-in-the-middle, ransomware, and Telegram-based C2.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified a new **Svpeng** Android banking trojan variant, `Trojan-Banker.AndroidOS.Svpeng.ae`, that expanded the malware family’s capabilities by abusing Android accessibility services to capture keystrokes and other user activity. The malware can grant itself broad privileges, hinder removal, steal text entered into other applications, take screenshots, display phishing overlays on targeted apps, and receive commands from a command-and-control server. The campaign was observed in limited volumes across **23 countries**, with the largest shares in Russia, Germany, and Turkey, although the malware was designed not to run on devices using the Russian language setting. The sample was distributed through malicious websites posing as a fake **Flash Player** update, and researchers said the technique remained effective even against fully updated Android devices.
Aug 14, 2026
A newly discovered Android banking trojan named **Sturnus** has emerged, targeting financial institutions in Europe and demonstrating advanced capabilities beyond typical mobile malware. Sturnus can capture messages from end-to-end encrypted messaging apps such as Signal, WhatsApp, and Telegram by accessing content after decryption directly from the device screen. The malware also enables full device takeover, credential theft through region-specific HTML overlays, and real-time remote control via VNC sessions. Infection typically begins with malicious APKs disguised as legitimate apps like Google Chrome or Preemix Box, and the malware abuses Android Accessibility services to monitor user activity, capture keystrokes, and manipulate the device interface. Sturnus communicates with its command-and-control infrastructure using a combination of plaintext, RSA, and AES-encrypted channels, establishing secure connections for both data exfiltration and live monitoring. Once installed, it registers the victim device through a cryptographic exchange and can obtain Device Administrator privileges, allowing it to track password changes, lock the device, and maintain persistence. The trojan is currently under active development and is believed to be distributed via malvertising or direct messages, with researchers noting its private operation and ongoing evaluation phase. Security experts warn that Sturnus represents a significant escalation in Android banking malware sophistication, particularly due to its ability to bypass encrypted messaging protections and facilitate financial fraud.
Jun 29, 2026
Researchers and Italy’s CERT-AGID reported that the Android banking trojan **Oscorp**, later tracked as **UBEL**, was distributed through a malicious APK site in Italy and evolved into a broader global campaign targeting more than 150 applications, including banking apps. The malware abused Android’s **Accessibility Service** to gain extensive control over infected devices, repeatedly coercing victims to grant accessibility, usage statistics, battery optimization exemptions, and sometimes device administrator privileges to maintain persistence and expand access. Once active, UBEL/Oscorp could steal credentials through phishing overlays rendered in a `WebView`, intercept SMS messages, place calls, trigger call forwarding, execute USSD requests, launch or remove apps, and block legitimate applications. Analysts also documented screen and audio capture via **WebRTC/STUN**, HTTP POST communications with command-and-control servers, and specialized theft functions including replacement of cryptocurrency wallet addresses and harvesting of Google Authenticator one-time codes; published indicators included malware hashes, package names, C2 domains, injection paths, and AES keys tied to the operation.
Aug 15, 2026