Ransomware Threat to Android Smartphones & Targets Gmail Cookies

Cookies from Gmail, GPay, and Google Password Manager are in the crosshairs

Although banking, shopping, and, perhaps predictably enough, crypto wallets and exchanges are the main targets, SOVA’s latest version reportedly has more than 200 apps on the list.

Cleafy’s report on cookie-stealing stated that the “cookie stealer mechanism” was “refactored, improved,” and included a “comprehensive Google services list.” Cleafy stated that Gmail and GPay were included in this list.

Ransomware for smartphones is now a thing

The most alarming new development is SOVA version 5. Although still in development, SOVA version 5 has already begun to appear in the hands and hands of threat actors. Cleafy has received “multiple samples” through its threat intelligence platform. This is due to the addition of a ransomware program. You heard it right. Ransomware can be installed on smartphones.

The SOVA ransomware function could have been triggered by evidence of theft from crypto-wallets.

This module appears to allow for the encryption of files using the AES algorithm. This could be a strategic move by the criminal side, even though a lot of data is stored or backed up in the cloud. Although factory resetting your phone is the best option, it’s possible that many users, particularly those with less technical skills, will be willing to pay a ransom to have their phone work properly again. To understand why this happens, you only need to consider the panic you feel when your phone is lost or stolen.

Dark Reading reports indicate that SOVA targets crypto wallets. The ransomware module could be used to destroy evidence, making it difficult for digital forensics to find any trace or assign the attacker.

Android users should be careful, iPhone users can take a break

SOVA is an Android-only threat, which is a plus for iPhone users. Android users should be aware of where and how they are installed. While malicious apps have been infiltrated into the Google Play Store and other “official” stores, it is far more common for these apps to be downloaded from unofficial third-party depositories.