“SOVA”, a recently discovered Android trojan with the potential of exfiltrating personally identifiable information (PII) from infected devices, has been identified targeting banking and shopping applications as well as cryptocurrency wallets from the United States and Spain. “SOVA” was discovered in early August 2021 by ThreatFabric, a cybersecurity firm based in Amsterdam, and the current version of the malware, despite being in its early stages of development, has many features that allow for logging keystrokes, hiding notifications, modifying the clipboard to insert external cryptocurrency wallets, and exfiltrating credentials and session cookies through web overlay attacks. It is noted that future plans of the malware are to include executing DDoS attacks, deploying ransomware, intercepting two-factor authentication codes, and committing on-device fraud though Virtual Network Computing (VNC). ThreatFabric, in their report linked below, described that the future plans of SOVA “would push S.O.V.A. into a different realm for Android malware, making it potentially one of the most advanced bots in circulation, combining banking malware with automation and botnet capabilities”. The developers of SOVA have advertised the malware on hacking forums and are seeking recruits to trial the malware at a large-scale. CTAPT will monitor the SOVA Android trojan as it evolves its capabilities over time.